Overview

overview

7

Static

static

3

542125699b...d2.exe

windows7-x64

7

542125699b...d2.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    76s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 04:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    542125699bda1d6021af5ac4e6954ed2.exe

  • Size

    16KB

  • MD5

    542125699bda1d6021af5ac4e6954ed2

  • SHA1

    ae486f186e3775920e092a095868f2f8ed3d59f8

  • SHA256

    cfe15d2df1942fc342b5ff432385415b2986b0a1426aee36b1285b4d10d9867d

  • SHA512

    bfd78f9dba3b4d7143bd316ec48f37ea9046f7a8f084dae077b799cb98826e38586b47a27233aa1c5caf70eef488123e7524017a21bf713d66a3f615c18ceacb

  • SSDEEP

    384:Iy76FphlRGXtBYAeewY81XYMjpAp8lO3hcczrfZRI:WPDRktBYAwxju6lOnrfZ+

Score
7/10
adwarestealer

Malware Config

Signatures

  • Executes dropped EXE 56 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 64 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\542125699bda1d6021af5ac4e6954ed2.exe
    "C:\Users\Admin\AppData\Local\Temp\542125699bda1d6021af5ac4e6954ed2.exe"
    1⤵
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621953.bat
      2⤵
        PID:880
      • C:\Windows\SysWOW64\stjxakin.exe
        C:\Windows\system32\stjxakin.exe
        2⤵
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661296.bat
          3⤵
            PID:2352
          • C:\Windows\SysWOW64\stjxakin.exe
            C:\Windows\system32\stjxakin.exe
            3⤵
            • Executes dropped EXE
            • Installs/modifies Browser Helper Object
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:228
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661687.bat
              4⤵
                PID:3688
              • C:\Windows\SysWOW64\stjxakin.exe
                C:\Windows\system32\stjxakin.exe
                4⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5976
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662031.bat
                  5⤵
                    PID:6076
                  • C:\Windows\SysWOW64\stjxakin.exe
                    C:\Windows\system32\stjxakin.exe
                    5⤵
                    • Executes dropped EXE
                    • Installs/modifies Browser Helper Object
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:5348
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662375.bat
                      6⤵
                        PID:5304
                      • C:\Windows\SysWOW64\stjxakin.exe
                        C:\Windows\system32\stjxakin.exe
                        6⤵
                        • Executes dropped EXE
                        • Installs/modifies Browser Helper Object
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:6516
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662718.bat
                          7⤵
                            PID:5788
                          • C:\Windows\SysWOW64\stjxakin.exe
                            C:\Windows\system32\stjxakin.exe
                            7⤵
                            • Executes dropped EXE
                            • Installs/modifies Browser Helper Object
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2296
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663062.bat
                              8⤵
                                PID:4980
                              • C:\Windows\SysWOW64\stjxakin.exe
                                C:\Windows\system32\stjxakin.exe
                                8⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:8116
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663390.bat
                                  9⤵
                                    PID:8164
                                  • C:\Windows\SysWOW64\stjxakin.exe
                                    C:\Windows\system32\stjxakin.exe
                                    9⤵
                                    • Executes dropped EXE
                                    • Installs/modifies Browser Helper Object
                                    • Drops file in System32 directory
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:5732
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663781.bat
                                      10⤵
                                        PID:6416
                                      • C:\Windows\SysWOW64\stjxakin.exe
                                        C:\Windows\system32\stjxakin.exe
                                        10⤵
                                        • Executes dropped EXE
                                        • Installs/modifies Browser Helper Object
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:6360
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664109.bat
                                          11⤵
                                            PID:7072
                                          • C:\Windows\SysWOW64\stjxakin.exe
                                            C:\Windows\system32\stjxakin.exe
                                            11⤵
                                            • Executes dropped EXE
                                            • Installs/modifies Browser Helper Object
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:5804
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664546.bat
                                              12⤵
                                                PID:6284
                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                C:\Windows\system32\stjxakin.exe
                                                12⤵
                                                • Executes dropped EXE
                                                • Installs/modifies Browser Helper Object
                                                • Drops file in System32 directory
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5756
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664921.bat
                                                  13⤵
                                                    PID:4552
                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                    C:\Windows\system32\stjxakin.exe
                                                    13⤵
                                                    • Executes dropped EXE
                                                    • Installs/modifies Browser Helper Object
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:8528
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665281.bat
                                                      14⤵
                                                        PID:8572
                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                        C:\Windows\system32\stjxakin.exe
                                                        14⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2176
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665796.bat
                                                          15⤵
                                                            PID:6620
                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                            C:\Windows\system32\stjxakin.exe
                                                            15⤵
                                                            • Executes dropped EXE
                                                            • Installs/modifies Browser Helper Object
                                                            • Drops file in System32 directory
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:6588
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666140.bat
                                                              16⤵
                                                                PID:7352
                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                C:\Windows\system32\stjxakin.exe
                                                                16⤵
                                                                • Executes dropped EXE
                                                                • Installs/modifies Browser Helper Object
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3744
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666515.bat
                                                                  17⤵
                                                                    PID:1840
                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                    C:\Windows\system32\stjxakin.exe
                                                                    17⤵
                                                                    • Executes dropped EXE
                                                                    • Installs/modifies Browser Helper Object
                                                                    • Drops file in System32 directory
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:6484
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666859.bat
                                                                      18⤵
                                                                        PID:6520
                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                        C:\Windows\system32\stjxakin.exe
                                                                        18⤵
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:7316
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667328.bat
                                                                          19⤵
                                                                            PID:7312
                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                            C:\Windows\system32\stjxakin.exe
                                                                            19⤵
                                                                            • Executes dropped EXE
                                                                            • Installs/modifies Browser Helper Object
                                                                            • Drops file in System32 directory
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5576
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667656.bat
                                                                              20⤵
                                                                                PID:6904
                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                C:\Windows\system32\stjxakin.exe
                                                                                20⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3068
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668031.bat
                                                                                  21⤵
                                                                                    PID:8016
                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                    21⤵
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:7216
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668359.bat
                                                                                      22⤵
                                                                                        PID:2480
                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                        22⤵
                                                                                        • Executes dropped EXE
                                                                                        • Installs/modifies Browser Helper Object
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:6408
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668828.bat
                                                                                          23⤵
                                                                                            PID:7084
                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                            23⤵
                                                                                            • Executes dropped EXE
                                                                                            • Installs/modifies Browser Helper Object
                                                                                            • Drops file in System32 directory
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4944
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669140.bat
                                                                                              24⤵
                                                                                                PID:8292
                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                24⤵
                                                                                                • Executes dropped EXE
                                                                                                • Installs/modifies Browser Helper Object
                                                                                                • Drops file in System32 directory
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:7768
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669468.bat
                                                                                                  25⤵
                                                                                                    PID:7852
                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                    25⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:7524
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669828.bat
                                                                                                      26⤵
                                                                                                        PID:9152
                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                        26⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Installs/modifies Browser Helper Object
                                                                                                        • Drops file in System32 directory
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:5672
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670171.bat
                                                                                                          27⤵
                                                                                                            PID:5316
                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                            27⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:5740
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670515.bat
                                                                                                              28⤵
                                                                                                                PID:7056
                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                28⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:9012
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670859.bat
                                                                                                                  29⤵
                                                                                                                    PID:7364
                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                    29⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Installs/modifies Browser Helper Object
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:8176
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671218.bat
                                                                                                                      30⤵
                                                                                                                        PID:8644
                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                        30⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Installs/modifies Browser Helper Object
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:3772
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671562.bat
                                                                                                                          31⤵
                                                                                                                            PID:5716
                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                            31⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:6244
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671890.bat
                                                                                                                              32⤵
                                                                                                                                PID:7368
                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                32⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:8592
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672203.bat
                                                                                                                                  33⤵
                                                                                                                                    PID:6496
                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                    33⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:7924
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672828.bat
                                                                                                                                      34⤵
                                                                                                                                        PID:2680
                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                        34⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies registry class
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:8828
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673125.bat
                                                                                                                                          35⤵
                                                                                                                                            PID:2540
                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                            35⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Installs/modifies Browser Helper Object
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:8812
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673468.bat
                                                                                                                                              36⤵
                                                                                                                                                PID:8328
                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                36⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:8160
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674015.bat
                                                                                                                                                  37⤵
                                                                                                                                                    PID:6868
                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                    37⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:9412
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674421.bat
                                                                                                                                                      38⤵
                                                                                                                                                        PID:9440
                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                        38⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Installs/modifies Browser Helper Object
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:6364
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674937.bat
                                                                                                                                                          39⤵
                                                                                                                                                            PID:8672
                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                            39⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Installs/modifies Browser Helper Object
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:6080
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675296.bat
                                                                                                                                                              40⤵
                                                                                                                                                                PID:5160
                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                40⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:5276
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675687.bat
                                                                                                                                                                  41⤵
                                                                                                                                                                    PID:5240
                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                    41⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Installs/modifies Browser Helper Object
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:5828
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676046.bat
                                                                                                                                                                      42⤵
                                                                                                                                                                        PID:6384
                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                        42⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Installs/modifies Browser Helper Object
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:6088
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676406.bat
                                                                                                                                                                          43⤵
                                                                                                                                                                            PID:7896
                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                            43⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Installs/modifies Browser Helper Object
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:10056
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676796.bat
                                                                                                                                                                              44⤵
                                                                                                                                                                                PID:9848
                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                44⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:5584
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677187.bat
                                                                                                                                                                                  45⤵
                                                                                                                                                                                    PID:1472
                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                    45⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Installs/modifies Browser Helper Object
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:8772
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677546.bat
                                                                                                                                                                                      46⤵
                                                                                                                                                                                        PID:9668
                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                        46⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Installs/modifies Browser Helper Object
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:1796
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677937.bat
                                                                                                                                                                                          47⤵
                                                                                                                                                                                            PID:8656
                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                            47⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Installs/modifies Browser Helper Object
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:4420
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240678343.bat
                                                                                                                                                                                              48⤵
                                                                                                                                                                                                PID:9660
                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                48⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:8928
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240678875.bat
                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                    PID:9768
                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Installs/modifies Browser Helper Object
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:5168
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240679265.bat
                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240679859.bat
                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                            PID:6436
                                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:5504
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240680281.bat
                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                PID:5428
                                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240680625.bat
                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240680968.bat
                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Installs/modifies Browser Helper Object
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:8848
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240681296.bat
                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                            PID:7532
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Installs/modifies Browser Helper Object
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:8020
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240681656.bat
                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                PID:5196
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240682000.bat
                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                    PID:6680
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:7416
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240716546.bat
                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                        PID:7960
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                          PID:9292
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240717921.bat
                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                              PID:7328
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                              C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                PID:11044
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240718484.bat
                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                    PID:11092
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240719015.bat
                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                          PID:7504
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                            PID:6500
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240719390.bat
                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240719828.bat
                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                      PID:9456
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                        PID:10236
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240720343.bat
                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                            PID:7760
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                              PID:4336
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240720687.bat
                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                    PID:11376
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240721125.bat
                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                        PID:11412
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                          PID:10660
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240721546.bat
                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                              PID:10544
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                PID:10712
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240721953.bat
                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                    PID:11132
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                      PID:11004
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240722453.bat
                                                                                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                                                                                          PID:11180
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                            PID:10432
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240723109.bat
                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                PID:10592
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                  PID:9828
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240723703.bat
                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                      PID:10284
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                        PID:10044
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240724171.bat
                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                            PID:8184
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                              PID:9364
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240724718.bat
                                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                                  PID:6824
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                    PID:7576
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240725109.bat
                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                        PID:12220
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                          PID:8524
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240725562.bat
                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                              PID:8516
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                                                                                PID:9032
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240726046.bat
                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                    PID:9976
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6700
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240726421.bat
                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5644
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6764
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240726812.bat
                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                PID:12248
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7672
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240727218.bat
                                                                                                                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:11600
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:10588
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240727796.bat
                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:10276
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:8756
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240728296.bat
                                                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:11020
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:10640
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240728687.bat
                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:12104
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:9336
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240729031.bat
                                                                                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:9372
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:10440
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240729468.bat
                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:10264
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:10476
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240731765.bat
                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:740
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:9024
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240732171.bat
                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:11340
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240732578.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11720
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240732968.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7804
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7332
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240737890.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11460
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240738265.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Installs/modifies Browser Helper Object
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7968
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240738656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6512
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240739062.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240743375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7744
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12028
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240743718.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7464
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240744062.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240754328.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240754765.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240764625.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240763953.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240744531.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240763484.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240763140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240762750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240762250.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240759468.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240759296.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240758906.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240758343.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240757765.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240757375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240756968.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240756531.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240756093.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240755640.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240755312.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240754750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240754312.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753796.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753796.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753796.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240753828.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240748406.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240724156.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11244
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240714656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240714656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9772
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240704890.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8304
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240704531.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7380
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240704046.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8768
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240703734.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240703406.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240702812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6840
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240702375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10076
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240702015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7240
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240701718.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6964
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240701375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8984
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240701062.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240700687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240700359.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                25⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6948
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240700000.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8816
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240699656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240699328.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240699031.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240698578.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240698187.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8420
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240697796.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9352
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240697359.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:764
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240697000.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8464
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240696625.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7916
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240696359.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240695843.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9076
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240695375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9584
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240695062.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240694593.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6800
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240694328.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7016
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240693890.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8056
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240693578.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240693218.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240693140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9208
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240693140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9116
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240691781.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7788
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240759953.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8120

                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\~DFD240621953.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                121B

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                09517fc62284f33e877a276463580bd1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                0b14fe1db4493818f9de0bf2a56ee5370b8d479a

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\~DFD240693140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                121B

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                fbe040169fe8d8da373af471238e2139

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                5bd0bb0f3da2df996354d666a2974cce7c790257

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                60cf091534f758a9c4514b4243fa1f31570187311cbabc136d9b5bfb1d71d0da

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                e342ebf3179f7f30527657868a663c2572ff2054adde49b2ff65f298a9188bece720d0f4cd696f8f255ec60cd3a51c66e8e09c2a62ad0e961198caae837ad569

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\~DFD240753812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                363B

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                75e9a9e1615ff5135c41c47e986ea125

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                bc0c158a97c7bbd9abc1077f2d9b0a8e5c719fe3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                964be04e2a2679564c4d0eb545ce0a721d4370b5628b0d4a75031e20609f067b

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                d3c3f853740e807996dcfa07f11b206081a8ab7725fae96bf9a2ee1511b9b51d28e860047967d2e46358c5d41284d430b33b6e5d86feb0c500e2d9073e3ee6b9

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                5KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                1d230246b36043365992c1216e90aa82

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                d654eb34617c6b413569433c15022497fdf150c4

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                abff39eaa8982983204cc17f8c0089781b4db04c770f18499cb09b6dec17e229

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                2a49f75b32b0d700d8376a82638d4460936ffccd5b20b2724414ace028e14c913be3c82b64d0de0e28606e926f015291ef7b2445782671719832f538afd6fd52

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                9c19410e8c397b363bd56a95c80fc8e9

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                47636558fb5eba16f172c84bec44a86fefcc1f08

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                2bcd6f90c573d7bdbd7d4cf929267337a40c319c5e9c68b4acbb2dc3fba819fb

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                976670ab73ab66dfda687b1d0c92e308ed0afc2eb8ac7393910c90e61383498891f13869ae04ac3bb5a4d71e8a3b2a57d3375b3a726c1001554d267b1c7348c4

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                e758215666d2bb31e0e6101ef80252a5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                628086e28805e687a263270698ea6af70990aae3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6568424dc9dd0cc492bc14ba9fe21bdb4ad2ac4a252193c220de379f069030f9

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                1d5377c254d6f205c4c8f7127d46ee3d6c00d373235e9c1274eb5831e9ca68e19e6f276c7daad471dcb94d5147bd03b090ff92cf5fce44b62be0eb53abb20ad7

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                f5bdfa965bdd81dcb16215e1bc4f7eb7

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                41c10588da7b38d0a876df8bef3d9d078c251f29

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                a9c38158c844ab6141019266d32bab4c100f03b0fefde9fb4b471d9d5a41b3d3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                bb5072bd8fe086d1d46372b580355817f5fb5644f472b5dc18e1b9c3d3f874d897b5cc5844207fd6a4156d1532937d5a960de4c55709e1c56e6deecc36121d3f

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                554771f9b56b9877766b0373511c1e56

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                89125f71326a0c84b488f215086d5a8248a7969c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                020c69a348bcb1c56f6319cd1d2d0c20bc5d234c88acad2763ba726cfb19ca1c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                e4af02b87183cf37468d06119160d275d20ad856aa457c5cbac6f2da03951c0981063951a39e1e6fdf7919e73bd6f21de1974ffa03fbc15c98891db7fdac3a61

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                ddffbe68f9b3094569c4aa2f5144b4e1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                05397c2cf87281e938ae1cbddf89d997316609de

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                8fff5f6239ffef4280e039dfe18b6d0105048feb3c8b582985e5f77f5d676648

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                c189056e622467bc0615543da92b6abc72e83fe72bbd85f382aacbe850d70eaad659a06bb03f3ad64d58b7466df06b7699baf05cfa721f906ab7653dcf0725ac

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                202bd14e8dcf73887a82075dac85e5de

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                c0086f92ec42ff2a7fee75db83b1bd79964d435d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                55c308fd425b5463d4d8a2dc03cd67ebfeb06e7719c0fe9764ae1c77e9a94c9f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                cff5b6a6bb5fd7cd401fe10ea8754fb0d255086181b984056251050330f9a683e576ab22433b43904abe44bb45d3df7df519456a99ce14a352c9880fc54fc1a9

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                6e33d41433c449f969473567f3668005

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                6f2f746a10e7ac2d465823394d2412135a28e718

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                d69e89d1e579ee7e93a9fa6239df32efa4c4eba2fd42dec2b6569a3147e74687

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                b32d544ed984af1ea5295df955f744a70605e3613cc2650fc4b9b645eae830de5ad58374b1f1babd06293bcbd0dd317a1f1c2118b8f4822066b2c48979391e40

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                84946dcbc1009b575361c86864c05f1f

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                122db35c2c18e16788a0af5d52d0d9a65d1157dd

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                7414d312341aaf8528c83ce7aad682fd64914e3906fb6d3772a515691be5221b

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                7f7f95c7678d2437ec969801dd253bc9c3797df26efa6d458ddae764865b04efe7181e3c1250414f88ec6d99b126f2fa3109397ba7cd58aee3776fd17182667f

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                7601bdcf8e254cffb509e7ea05ceda68

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                9c08720abf84b53bd67d60df25a3c8e31b34bd2d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                f34de2a13c6040958880676fcf95652060e6805841d7a8e0549b9434a6e54b31

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                29ca7f142b74b37b2a5589164088f423b84337c5dee87be7bc8be0a6692d646a2d867c39fc5b4bd62dfbcaaf1196db26a39c3638395c7cb937fdebab33676a16

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                b9d9354290be26e3a2d4cc44e5c2662a

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                e4a08e23c816cac3bb1792fc64073673e675ca7b

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                6f5cd208d8a6ef3649b0995e195f53bfe03eb31b13efa61f701372c300e5fe1c

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                0d46eee985b4a4e7de4ddfc9c5cb233a66e7876928af0c93b95b2674056d4dfb3e03fa0f8d06a8b0108b037850f6867377592d3d3e079b33f74e817d93275fc5

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                126bf2bd81bd60cca8d26e7d39e4e05b

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                367fbc5925ef2b2bdf6c1e38d3bec7ee99429ba9

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                5d7c784b1f1c1a83b78a44bc87ff446585aad34c9b9575c8ce9629ef00b36dac

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                378de0d2273c8f19b46e162bd5d12f55d7ce5007407022c025aebcdd59ef360a52b92f70fbb2032dfc2bf79ae86503c7673696a4ddceecc54fc6b8f9c8511f4b

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                16c21be145bed1e868738cf83b63f428

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                6cf82cb1dbfbcb8170098f86a5669aa3926bb3d0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                d593a0a0f4067c98151bc8b7a49bd8859fa6d9d8b061110689bebf4c03c784a5

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                77d95ed438941921ff0b0fe60d33ab3e47126e6750f2425c10aafb6c6d1eab27bfe2620a0bfc357ad26262886cdfae34f4e9efbbd30aa705e4b9ac2b2fb75b6a

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                69a99134ede990b192f34dbd1a62df2d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                9d2714a600767721de0221d12dfda24a7c70a083

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                00f22ee5d42cc4fffced84d7d38ddd6b62f1ee193535448ac0d06a7633a677b3

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                cce156da8f4f88c7f0176c9438514031a849b57bbe532f993259189642d1cc598fc721777516be2383032d772e71b53e4dd0171f69d29f54d55a18d6bf717dd5

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                fae138adc26dcbd246d12c5e88d790a1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                76fe07148e774ae57fd48760bd951b9e5df34737

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                05a4ff0e59fea10b283ff3013c07bdba114050b845ca84377238b2f754ad1ece

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                c4eac1a7d848f13aecdae6c9c876f4b7aea2f77876c40ad072e027592af53d6bf109a1556ae8517f33beaf395b706a64c1546ef721b5b7774c09e5809fe7616e

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\erjxakin.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                5KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                561a97b7b991064a326c486d7423ab10

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                13a0530164935e8ab4aa03b9d3408cd6ca694fd1

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                0d00eb39f787044e52a53f44e984198e29d638a869b93fc42c8018aa99d94aa0

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                5d3c76eb091642ede2fae188262536892843d30fffbf3e67b7890770e302ed62f524807acd835fb104933ae1befc35f0f375ec1eac3c5178e8087030ffd161b9

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rijxbkin.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                524KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                a9fbf2fdb36b23407aaca4f78ca39094

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                678024c727517d112b8acec2cbbd9b55c30b6e29

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                567f162613f6258172d88231aed4db6402e93a80d9367b63b866040047c39a01

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                1e3ad3312e1412c85745bac2f0fc3364361ceae29a4a745f6a0f29d29f632b3392fbefa2f31ffc6a73b01d4135a3cac5d6aaf87c4453f52d22e27e9dc55276e6

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rijxbkin.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                46KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                19878cfb7f40f9bfedec6a573cb6b0ef

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                e4723976da609ca751fc159f05df854ae0d18da8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                ddc78204b47ac140fabff5e19c5dc08f143eb774cd845dabe63711b19b9968cd

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                aa6b65b305cb1fda401fc019b4e0295c6f039ba01ca388bd1199b6010e31bc46610f54665b991c5cf878279e3422edb4ab0f2c028f980a5f6aef738eab4c5b2e

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\stjxakin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                542125699bda1d6021af5ac4e6954ed2

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                ae486f186e3775920e092a095868f2f8ed3d59f8

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                cfe15d2df1942fc342b5ff432385415b2986b0a1426aee36b1285b4d10d9867d

                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                bfd78f9dba3b4d7143bd316ec48f37ea9046f7a8f084dae077b799cb98826e38586b47a27233aa1c5caf70eef488123e7524017a21bf713d66a3f615c18ceacb

                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/228-2042-0x0000000000400000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2492-0-0x0000000000400000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2492-1020-0x0000000000400000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3336-11206-0x0000000000400000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5976-3061-0x0000000000400000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6244-30495-0x0000000000400000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/8176-28466-0x0000000000400000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                Download