b9bffd213bd6b3f14692f1f5cf0196f614bbe611b9bce5032e6fba221b77aa5b

Analysis

max time kernel
874s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client_build (1).exe
Size 605KB
Sample260929-3as2lsszhy
SHA256 b9bffd213bd6b3f14692f1f5cf0196f614bbe611b9bce5032e6fba221b77aa5b
MD5 59d25355acb8737368892da612026998
SHA1 78e07ae03e28df3eb2ff4a694fa25613a36647da
SHA512 57172d646708154aa279d7e998b9d689e1204e6e360397b192dc0290b0cca07706e43afb9b4b50bc26cdaed6885210c3f112d43dee0d7301ef6c8ebdb55853f6
SSDEEP 6144:UacHntdmS+p1I1qkbM9bjv/kjJ7FfELc2wKvS6Xa1lTJNwibWmKSbizhbYL61YCh:UBnPmzpqIkq3aJ7SGwkWYE5y
TLSH
T1EBD47E30B2D54D3BC7DF097F58684A69BC7068CB8212E6085459B7FA6B04B6087BC7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHostService.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client_build (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client_build (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHostService.exe	svchost.exe

Executes a file named after a Windows system binary 1 TTPs 64 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost\svchost.exe	svchost.exe

Executes dropped EXE 64 IoCs

pid	Process
5072	svchost.exe
4272	svchost.exe
3076	svchost.exe
6024	svchost.exe
4512	svchost.exe
5760	svchost.exe
1460	svchost.exe
4260	svchost.exe
3192	svchost.exe
6056	svchost.exe
4656	svchost.exe
4892	svchost.exe
5460	svchost.exe
1972	svchost.exe
5824	svchost.exe
828	svchost.exe
3996	svchost.exe
4612	svchost.exe
2332	svchost.exe
4652	svchost.exe
776	svchost.exe
5068	svchost.exe
2180	svchost.exe
4944	svchost.exe
5632	svchost.exe
5992	svchost.exe
1140	svchost.exe
3516	svchost.exe
1244	svchost.exe
2980	svchost.exe
3240	svchost.exe
4264	svchost.exe
5252	svchost.exe
5608	svchost.exe
2668	svchost.exe
2384	svchost.exe
4032	svchost.exe
4840	svchost.exe
3372	svchost.exe
2864	svchost.exe
4224	svchost.exe
4068	svchost.exe
3460	svchost.exe
1348	svchost.exe
5392	svchost.exe
1252	svchost.exe
1868	svchost.exe
5364	svchost.exe
5092	svchost.exe
3740	svchost.exe
544	svchost.exe
1444	svchost.exe
4644	svchost.exe
6064	svchost.exe
4104	svchost.exe
2036	svchost.exe
5736	svchost.exe
4736	svchost.exe
3600	svchost.exe
3940	svchost.exe
4952	svchost.exe
1240	svchost.exe
972	svchost.exe
5348	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\HostProcessSvchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost\\svchost.exe\""	client_build (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\HostProcessSvchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HostProcessSvchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost\\svchost.exe\""	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x000e00000001c550-10.dat	ConfuserEx

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wall_b5d698f6.jpg"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wall_868f8a2a.jpg"	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1048	cmd.exe
1060	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1060	cmd.exe
1240	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
1748	client_build (1).exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
4272	svchost.exe
4272	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe
5072	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	client_build (1).exe
Token: SeDebugPrivilege	5072	svchost.exe
Token: SeDebugPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: SeDebugPrivilege	4272	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: SeDebugPrivilege	5072	svchost.exe
Token: SeDebugPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe
Token: 33	5072	svchost.exe
Token: SeIncBasePriorityPrivilege	5072	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 5072	1748	client_build (1).exe	90
PID 5072 wrote to memory of 4272	5072	svchost.exe	91
PID 5072 wrote to memory of 1048	5072	svchost.exe	92
PID 5072 wrote to memory of 5752	5072	svchost.exe	93
PID 5072 wrote to memory of 1060	5072	svchost.exe	98
PID 1060 wrote to memory of 3372	1060	cmd.exe	100
PID 1060 wrote to memory of 1240	1060	cmd.exe	101
PID 1060 wrote to memory of 812	1060	cmd.exe	102
PID 3076 wrote to memory of 6024	3076	svchost.exe	105
PID 6024 wrote to memory of 4512	6024	svchost.exe	107
PID 4512 wrote to memory of 5760	4512	svchost.exe	108
PID 5760 wrote to memory of 1460	5760	svchost.exe	109
PID 1460 wrote to memory of 4260	1460	svchost.exe	110
PID 4260 wrote to memory of 3192	4260	svchost.exe	111
PID 3192 wrote to memory of 6056	3192	svchost.exe	112
PID 6056 wrote to memory of 4656	6056	svchost.exe	113
PID 4656 wrote to memory of 4892	4656	svchost.exe	114
PID 4892 wrote to memory of 5460	4892	svchost.exe	115
PID 5460 wrote to memory of 1972	5460	svchost.exe	116
PID 1972 wrote to memory of 5824	1972	svchost.exe	117
PID 5824 wrote to memory of 828	5824	svchost.exe	118
PID 828 wrote to memory of 3996	828	svchost.exe	119
PID 3996 wrote to memory of 4612	3996	svchost.exe	120
PID 4612 wrote to memory of 2332	4612	svchost.exe	121
PID 2332 wrote to memory of 4652	2332	svchost.exe	122
PID 4652 wrote to memory of 776	4652	svchost.exe	123
PID 776 wrote to memory of 5068	776	svchost.exe	124
PID 5068 wrote to memory of 2180	5068	svchost.exe	125
PID 2180 wrote to memory of 4944	2180	svchost.exe	132
PID 4944 wrote to memory of 5632	4944	svchost.exe	133
PID 5632 wrote to memory of 5992	5632	svchost.exe	134
PID 5992 wrote to memory of 1140	5992	svchost.exe	135
PID 1140 wrote to memory of 3516	1140	svchost.exe	136
PID 3516 wrote to memory of 1244	3516	svchost.exe	137
PID 1244 wrote to memory of 2980	1244	svchost.exe	138
PID 2980 wrote to memory of 3240	2980	svchost.exe	139
PID 3240 wrote to memory of 4264	3240	svchost.exe	140
PID 4264 wrote to memory of 5252	4264	svchost.exe	141
PID 5252 wrote to memory of 5608	5252	svchost.exe	142
PID 5608 wrote to memory of 2668	5608	svchost.exe	143
PID 2668 wrote to memory of 2384	2668	svchost.exe	144
PID 2384 wrote to memory of 4032	2384	svchost.exe	145
PID 4032 wrote to memory of 4840	4032	svchost.exe	146
PID 4840 wrote to memory of 3372	4840	svchost.exe	147
PID 3372 wrote to memory of 2864	3372	svchost.exe	148
PID 2864 wrote to memory of 4224	2864	svchost.exe	149
PID 4224 wrote to memory of 4068	4224	svchost.exe	150
PID 4068 wrote to memory of 3460	4068	svchost.exe	151
PID 3460 wrote to memory of 1348	3460	svchost.exe	152
PID 1348 wrote to memory of 5392	1348	svchost.exe	153
PID 5392 wrote to memory of 1252	5392	svchost.exe	154
PID 1252 wrote to memory of 1868	1252	svchost.exe	155
PID 1868 wrote to memory of 5364	1868	svchost.exe	156
PID 5364 wrote to memory of 5092	5364	svchost.exe	157
PID 5092 wrote to memory of 3740	5092	svchost.exe	158
PID 3740 wrote to memory of 544	3740	svchost.exe	159
PID 544 wrote to memory of 1444	544	svchost.exe	160
PID 1444 wrote to memory of 4644	1444	svchost.exe	161
PID 4644 wrote to memory of 6064	4644	svchost.exe	162
PID 6064 wrote to memory of 4104	6064	svchost.exe	163
PID 4104 wrote to memory of 2036	4104	svchost.exe	164
PID 2036 wrote to memory of 5736	2036	svchost.exe	165
PID 5736 wrote to memory of 4736	5736	svchost.exe	166
PID 4736 wrote to memory of 3600	4736	svchost.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\client_build (1).exe
"C:\Users\Admin\AppData\Local\Temp\client_build (1).exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5072
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c @echo off & :loop & timeout /t 2 /nobreak >nul & tasklist /FI "PID eq 5072" 2>NUL | find /I "5072">NUL & if errorlevel 1 (start "" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" & exit) else (goto loop)
    3⤵
    - Executes a command shell one-liner
    PID:1048
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn "WindowsHostUpdateService" /tr "\"C:\Users\Admin\AppData\Roaming\svchost\svchost.exe\"" /sc minute /mo 5 /f /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3372
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1240
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:812

C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3076
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4512
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5760
    - - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:1460
      - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1460
        6⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        7⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3192
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6056
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        9⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4656
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        11⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:5460
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5460
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        13⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5824
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        15⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3996
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        17⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2332
        18⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        19⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 776
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        21⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2180
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        23⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:5632
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5632
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        25⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1140
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1244
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        29⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3240
        30⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5252
        32⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5608
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        33⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2668
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4032
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3372
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        39⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4224
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        41⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3460
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5392
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        45⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1868
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5364
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        47⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5092
        48⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        49⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 544
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        51⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4644
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6064
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4104
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5736
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5736
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        57⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:3600
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3600
        58⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        59⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4952
        60⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        61⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:972
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 972
        62⤵
        Executes dropped EXE
        
        PID:5348
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        63⤵
        Executes a file named after a Windows system binary
        
        PID:4844
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4844
        64⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        65⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4204
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4204
        66⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        67⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1904
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1904
        68⤵
        Executes a file named after a Windows system binary
        
        PID:5396
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        69⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2936
        70⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        71⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2628
        72⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        73⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2624
        74⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        75⤵
        Executes a file named after a Windows system binary
        
        PID:4856
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4856
        76⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        77⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3244
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3244
        78⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        79⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5676
        80⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        81⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5560
        82⤵
        Executes a file named after a Windows system binary
        
        PID:5728
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        83⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5988
        84⤵
        Executes a file named after a Windows system binary
        
        PID:2536
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        85⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4740
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4740
        86⤵
        Executes a file named after a Windows system binary
        
        PID:1476
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        87⤵
        Executes a file named after a Windows system binary
        
        PID:1860
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1860
        88⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        89⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4624
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4624
        90⤵
        Executes a file named after a Windows system binary
        
        PID:5660
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        91⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3576
        92⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        93⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5336
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5336
        94⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        95⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4960
        96⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        97⤵
        Executes a file named after a Windows system binary
        Reads the TCP/IP host and domain name from the registry
        
        PID:3984
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3984
        98⤵
        Executes a file named after a Windows system binary
        
        PID:5980
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        99⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4356
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4356
        100⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        101⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6200
        102⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        103⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:6388
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6388
        104⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        105⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6580
        106⤵
        Executes a file named after a Windows system binary
        
        PID:6680
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        107⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6768
        108⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        109⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7112
        110⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        111⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6416
        112⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        113⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5476
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5476
        114⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        115⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4700
        116⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        117⤵
        Executes a file named after a Windows system binary
        
        PID:1228
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1228
        118⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        119⤵
        Executes a file named after a Windows system binary
        Reads the TCP/IP host and domain name from the registry
        
        PID:5840
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5840
        120⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        121⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5668
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5668
        122⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        123⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6232
        124⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        125⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:7380
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7380
        126⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        127⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7740
        128⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        129⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8104
        130⤵
        Executes a file named after a Windows system binary
        
        PID:7280
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        131⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7480
        132⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        133⤵
        Executes a file named after a Windows system binary
        
        PID:1608
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1608
        134⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        135⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:6892
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6892
        136⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        137⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1992
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1992
        138⤵
        Executes a file named after a Windows system binary
        
        PID:5716
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        139⤵
        Executes a file named after a Windows system binary
        
        PID:4288
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4288
        140⤵
        Executes a file named after a Windows system binary
        
        PID:8144
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        141⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:8248
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8248
        142⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        143⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8652
        144⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        145⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9036
        146⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        147⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6220
        148⤵
        Executes a file named after a Windows system binary
        
        PID:8484
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        149⤵
        Executes a file named after a Windows system binary
        Reads the TCP/IP host and domain name from the registry
        
        PID:3644
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3644
        150⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        151⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6848
        152⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        153⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8656
        154⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        155⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2480
        156⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        157⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6964
        158⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        159⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6968
        160⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        161⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:6124
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6124
        162⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        163⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7192
        164⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        165⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2560
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2560
        166⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        167⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:9292
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9292
        168⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        169⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:9728
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9728
        170⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        171⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10108
        172⤵
        Executes a file named after a Windows system binary
        
        PID:4300
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        173⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5904
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5904
        174⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        175⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10216
        176⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        177⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:7288
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7288
        178⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        179⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2780
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2780
        180⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        181⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5812
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5812
        182⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        183⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8300
        184⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        185⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7008
        186⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        187⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8468
        188⤵
        Executes a file named after a Windows system binary
        
        PID:9128
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        189⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:8880
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8880
        190⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        191⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:10164
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10164
        192⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        193⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10276
        194⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        195⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10684
        196⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        197⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 11172
        198⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        199⤵
        Executes a file named after a Windows system binary
        
        PID:9204
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9204
        200⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        201⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10924
        202⤵
        Executes a file named after a Windows system binary
        
        PID:11068
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        203⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 11184
        204⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        205⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10724
        206⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        207⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6692
        208⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        209⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9604
        210⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        211⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:10012
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10012
        212⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        213⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7964
        214⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        215⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1812
        216⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        217⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10452
        218⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        219⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4128
        220⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        221⤵
        
        PID:11692

C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
1⤵
PID:6928
- C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6928
  2⤵
  PID:6252
- - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:6208
  - - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6208
      4⤵
      PID:3288
    - - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        5⤵
        Executes a file named after a Windows system binary
        Reads the TCP/IP host and domain name from the registry
        
        PID:6740
      - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6740
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        7⤵
        Executes a file named after a Windows system binary
        Reads the TCP/IP host and domain name from the registry
        
        PID:2672
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2672
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        9⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:6420
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6420
        10⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        11⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6556
        12⤵
        Executes a file named after a Windows system binary
        
        PID:6468
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        13⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:6820
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6820
        14⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        15⤵
        Executes a file named after a Windows system binary
        Reads the TCP/IP host and domain name from the registry
        
        PID:1524
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 1524
        16⤵
        Executes a file named after a Windows system binary
        
        PID:2812
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        17⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7216
        18⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        19⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7576
        20⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        21⤵
        Executes a file named after a Windows system binary
        
        PID:7940
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7940
        22⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        23⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:7452
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7452
        24⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        25⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7760
        26⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        27⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7256
        28⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        29⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7744
        30⤵
        Executes a file named after a Windows system binary
        
        PID:2176
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        31⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3272
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3272
        32⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        33⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2732
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2732
        34⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        35⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8460
        36⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        37⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8848
        38⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        39⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5144
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5144
        40⤵
        Executes a file named after a Windows system binary
        
        PID:8264
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        41⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:7920
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7920
        42⤵
        Executes a file named after a Windows system binary
        
        PID:6652
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        43⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8864
        44⤵
        Executes a file named after a Windows system binary
        
        PID:5804
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        45⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8760
        46⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        47⤵
        Executes a file named after a Windows system binary
        
        PID:8568
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8568
        48⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        49⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:7864
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7864
        50⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        51⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2132
        52⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        53⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2960
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2960
        54⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        55⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:6240
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6240
        56⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        57⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2876
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2876
        58⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        59⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7344
        60⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        61⤵
        Executes a file named after a Windows system binary
        
        PID:9572
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9572
        62⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        63⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9948
        64⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        65⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 5596
        66⤵
        Executes a file named after a Windows system binary
        
        PID:7680
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        67⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:6660
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6660
        68⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        69⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 4216
        70⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        71⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10064
        72⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        73⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2408
        74⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        75⤵
        Executes a file named after a Windows system binary
        
        PID:8556
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8556
        76⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        77⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3024
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 3024
        78⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        79⤵
        Executes a file named after a Windows system binary
        
        PID:2212
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2212
        80⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        81⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7736
        82⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        83⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 856
        84⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        85⤵
        Executes a file named after a Windows system binary
        
        PID:7148
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 7148
        86⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        87⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10524
        88⤵
        Executes a file named after a Windows system binary
        
        PID:10936
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        89⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 11012
        90⤵
        Executes a file named after a Windows system binary
        
        PID:8584
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        91⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8996
        92⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        93⤵
        Executes a file named after a Windows system binary
        
        PID:8376
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8376
        94⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        95⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 6904
        96⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        97⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2080
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2080
        98⤵
        Executes a file named after a Windows system binary
        
        PID:11080
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        99⤵
        Executes a file named after a Windows system binary
        
        PID:2412
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 2412
        100⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        101⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9628
        102⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        103⤵
        Executes a file named after a Windows system binary
        
        PID:10016
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10016
        104⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        105⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 8504
        106⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        107⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 9008
        108⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        109⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10368
        110⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        111⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10908
        112⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        113⤵
        
        PID:11528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7032

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:8120

C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
1⤵
PID:10620
- C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 10620
  2⤵
  PID:6264
- - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
    3⤵
    PID:11312
  - - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" --watchdog 11312
      4⤵
      PID:11832
    - - C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
        5⤵
        
        PID:11928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
Size 605KB
SHA256 b9bffd213bd6b3f14692f1f5cf0196f614bbe611b9bce5032e6fba221b77aa5b
MD5 59d25355acb8737368892da612026998
SHA1 78e07ae03e28df3eb2ff4a694fa25613a36647da
SHA512 57172d646708154aa279d7e998b9d689e1204e6e360397b192dc0290b0cca07706e43afb9b4b50bc26cdaed6885210c3f112d43dee0d7301ef6c8ebdb55853f6
SSDEEP 6144:UacHntdmS+p1I1qkbM9bjv/kjJ7FfELc2wKvS6Xa1lTJNwibWmKSbizhbYL61YCh:UBnPmzpqIkq3aJ7SGwkWYE5y
TLSH
T1EBD47E30B2D54D3BC7DF097F58684A69BC7068CB8212E6085459B7FA6B04B6087BC7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-101-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/776-56-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/972-119-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/1140-65-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/1244-68-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/1460-35-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/1748-12-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1748-3-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1748-9-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/1748-7-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1748-6-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1748-5-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1748-0-0x00007FFC376FF000-0x00007FFC37700000-memory.dmp

Download

memory/1748-1-0x0000000000110000-0x00000000001AE000-memory.dmp

Download

memory/1748-4-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1748-8-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1748-2-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/1860-133-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/1868-95-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/1904-123-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/2180-59-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/2332-53-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/2624-126-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/2628-125-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/2668-77-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/2672-150-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/2936-124-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3076-29-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3192-38-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3240-71-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3244-128-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3372-83-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3460-89-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3576-135-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3600-113-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3984-138-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/3996-50-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4032-80-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4104-107-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4204-122-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4224-86-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4356-139-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4512-32-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4624-134-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4644-104-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4656-41-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4700-151-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4740-132-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4844-121-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4856-127-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4952-116-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/4960-137-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5072-17-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-16-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-11-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-13-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-14-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-15-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-25-0x000000001D360000-0x000000001D372000-memory.dmp

Download

memory/5072-24-0x000000001D3D0000-0x000000001D420000-memory.dmp

Download

memory/5072-23-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-22-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-20-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5072-19-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5072-18-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/5092-98-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5252-74-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5336-136-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5392-92-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5460-44-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5476-149-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5560-130-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5632-62-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5676-129-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5736-110-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5824-47-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/5988-131-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6200-140-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6208-146-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6388-141-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6416-147-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6580-142-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6740-148-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6768-143-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/6928-144-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download

memory/7112-145-0x00007FFC5A360000-0x00007FFC5A5C3000-memory.dmp

Download