hxxp://gofile[.]io/d/LOwlP7

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://gofile.io/d/LOwlP7

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4020	NOTEPAD.EXE
4020	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1944	msedge.exe
1944	msedge.exe
15528	msedge.exe
15528	msedge.exe
14516	msedge.exe
14516	msedge.exe
14784	identity_helper.exe
14784	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4344	dwm.exe
Token: SeChangeNotifyPrivilege	4344	dwm.exe
Token: 33	4344	dwm.exe
Token: SeIncBasePriorityPrivilege	4344	dwm.exe
Token: SeShutdownPrivilege	4344	dwm.exe
Token: SeCreatePagefilePrivilege	4344	dwm.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe
14516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 5036	1944	msedge.exe	89
PID 1944 wrote to memory of 5036	1944	msedge.exe	89
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 4748	1944	msedge.exe	90
PID 1944 wrote to memory of 1856	1944	msedge.exe	91
PID 1944 wrote to memory of 1856	1944	msedge.exe	91
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92
PID 1944 wrote to memory of 4528	1944	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gofile.io/d/LOwlP7
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf38846f8,0x7ffdf3884708,0x7ffdf3884718
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16864730108285665784,11067827086157421781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,16864730108285665784,11067827086157421781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,16864730108285665784,11067827086157421781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16864730108285665784,11067827086157421781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16864730108285665784,11067827086157421781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16864730108285665784,11067827086157421781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\xd.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "
1⤵
PID:5080

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\xd.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "
1⤵
PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
  2⤵
  PID:856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
    3⤵
    PID:5080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:3264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:15144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:16164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:8000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:11124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:12536
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:12064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:12088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:15076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:4408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:2332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:1372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:4512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15616
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:1808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:17320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:13332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:9920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:13156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:11276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
    3⤵
    PID:2552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:3296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:2908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:11000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10000
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:5132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:5968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:1856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:5976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:5860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:13448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:13464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:5868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:17360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:2892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:13020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:16016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:11616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:2924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:4996
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:5112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:9688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:9700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:10844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:7648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:7656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:9904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:9912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:10532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:11320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        15⤵
        
        PID:14512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        15⤵
        
        PID:15484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:11336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        15⤵
        
        PID:13724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        15⤵
        
        PID:13736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:10540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:15416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:6752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:11196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:4692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:17220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:17228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:3212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:17284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:15064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:11200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
  2⤵
  PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
    3⤵
    PID:4872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:2704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:3580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:4904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:8500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:5000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:3644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:11496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9932
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:3332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:4148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:4780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:12924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:13760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:13772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:15660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:15672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:3896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:12172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:16180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:15860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:4604
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:16244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:16252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:16112
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:17300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:17308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:1412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:17268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:4172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:3188
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:16844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:10916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:10064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:10084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:11420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:16884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:16468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:4508
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:15324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:15336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:9172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:10100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:10208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:13140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:14020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:10216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:13996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:14004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:5920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:16264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        14⤵
        
        PID:16276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:12528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:11800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        13⤵
        
        PID:16408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:17328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:16624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:5192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:14400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:8236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:9980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:5536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:11848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:7784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:13540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:6292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:6156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:10456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:8820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:15296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:7268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:13416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:16232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
    3⤵
    PID:4808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:3904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:5396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:6180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:8628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:8636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:14868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:9304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14848
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:6276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:12992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:7840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:15724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:9764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:17028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:10732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:11520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:15540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        12⤵
        
        PID:3540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        11⤵
        
        PID:12264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:6680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:8676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:15900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:14888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:15932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:5476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:6300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:12120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:13864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:12704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        10⤵
        
        PID:16604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:9572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        9⤵
        
        PID:13896
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:6448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:11464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:11476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        7⤵
        
        PID:7576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:11716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        8⤵
        
        PID:11724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
      4⤵
      PID:5144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:6568
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:10552
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        6⤵
        
        PID:10564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
        5⤵
        
        PID:6604

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:14516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdf38846f8,0x7ffdf3884708,0x7ffdf3884718
  2⤵
  PID:10664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:10220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:15528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:12312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:14940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:11968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:13748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:15088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 /prefetch:8
  2⤵
  PID:9164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,9835246853921122475,1012092300917107171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:14784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:11896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:15056

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:15536
- C:\Windows\system32\shutdown.exe
  shutdown l
  2⤵
  PID:16884
- C:\Windows\system32\shutdown.exe
  shutdown
  2⤵
  PID:17232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dcda8b707ed2a9bc1854d2d7819fa28a

SHA1
2f736011c66fa9e26af6c0b2dec96238753e5bca

SHA256
31842a5f7de5079c3fc41219455ec67a3c086e33af44861ac84c44ff4a91b4ed

SHA512
f894123917b0e85f65631ad0e605451878e9a86855a7569961ad6c149ada0fc5210e14246154d790788638d4b40be6908195d797ebc67f3f26581d00ab296cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73908dba-1dd7-40db-b87d-f0f5ede769fa.tmp

Filesize
6KB

MD5
640d15a72770cbc374ee05421d9b07b0

SHA1
b84ac2f0c5aea25db8ef6ce895fafb44f346152a

SHA256
6978c296b6ba48660404c642db2d902ed5950a52613bd2828a4c37a7a34c4bd3

SHA512
4ed507e7243f74a75f984da65765bd128e52e745c61dd3dd557d59a4d944a02c39e1c28960e9e3ab034097461fe709aac00739b39fb8010505eb11af61a7856d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
85fe98e4cd0b3d1853899846d1d02fc2

SHA1
bef4affd4dd06fd123c2aa617fc6206e44cab3fb

SHA256
8f444a71b813c388aa2fd52e12ff5c7b9b584fd9d1e55345db48bac39851bbf0

SHA512
93fb1f18ab203300b4e8d472c4f9af331a72c828e01a7bf8492d1180aac37e04e0d2f064bdc8dc284319e486d488d99d1fded522fe725aa43915a87596daca5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
4c1fd1cca916fe55d47b67d64527e1e5

SHA1
ff799cce3a02011aa959362c0b3c940e20ff519c

SHA256
ec9ecfaf98633c1dadffaf6b82cfbef1715196c542e4fac367a965645c2d0255

SHA512
0f0dee375069859739d935a6858a4fb34e9d8c7e417632e62478400a024a7e6512d682329f65f17416911dc7586f7aad173b17b0fa6824b45cab9e0a26729829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
6026bbddef4019c6e2f323429368ea76

SHA1
ed61d0c7aa8b777252c155fc76b0f4092d502d4b

SHA256
3ba2e524f686fd9f1914e250ccdbaca1d73980cc8c7b0b1a1f9b142e211ac2c8

SHA512
5193ea52ae48c03b9b78adc80e9c075e087974f1c0fdcd8d18087c26a06af39e8b0f070dfc5c710e07f2dd18f966f9334a56055d4527bdb62bd110b1045a424e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
1.6MB

MD5
c99f1f4f926b300b2cbccb7c9c70adfb

SHA1
f479751a92e078385da39a0082bd71b95cd2e565

SHA256
8d2279d4d5447a2e18c603d20242de75a69df55c5a153e9ee087959db2b72abe

SHA512
4e1ee923179ea5a43018fdbdc75818a260b538366be8332946b3524c12464923ac0b4109063dd58b3cbd9acaa8990950883946f2929f452445e7ad8b184dc11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7d5897e67ea635ba06800796540cd478

SHA1
06d51fbc7f7dbd10c7e1779f3733504e31c161a5

SHA256
f033848cc7ca92a44c850c870a0aa44847c793688edf6e344759000fc3c72042

SHA512
24897e1486d7b948e22f5b44cc2385b1ba39f95eedae46edd8d44e13b962263010878ae0f810ed25221b9abc859938f4720082ef3f89262ed701c4466e230823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
a49d9b69925aa14f699a6d05ab7bec18

SHA1
47d354d22607891d8de655ea431f24eefb76bee3

SHA256
aa02c0c044932089d25955daea00f6c826d60e7bb9783c8bedbebfceaf49c78b

SHA512
ea633c81e940bc33dbd14b9a7a465f828090a594ee48d26c3b8cab392e175c054f4d2ffbfea450e219304fde535ffb793f46429baf6f788ab3678d547b979a93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
8a70393d41c4e8809dc9b76a331111dc

SHA1
dd8584ee07918398be4606b830dc044240119a14

SHA256
2a84a9f9cd0a427c0306c9f87856d76808e322558aadf64b84ecbb1f714daa7b

SHA512
b1e4b54af8fdd1fd1099d7c577d39cd131881d728fcf3afabb26baa4f8c9c4fe16a319ab64cd8d6e69025dd83aa6aabddbb8160148eac0cf7907911478428679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
5eded5fe5ca7e342d530964d64d648a8

SHA1
0383f69c74dedf26180530beaf0dca3738cda06f

SHA256
d7619956514a76c843d3a51a4808927d607a2fc99f950590885c71153aec83e8

SHA512
ddfebb109e8389f62a14bf202e7edc4893a4aef1621db3de943626761f1c5834e91120d1125cef88b1b2cd97ac5b1fdea9269815ec27165b7a000ea4f3277684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
792B

MD5
c97562350fd799c442dad7ef3a5d522f

SHA1
a6ddb21501253ef1ed85f477f684d59e41ae85d8

SHA256
da50f92be7d08724791918b7a21ef1cb4938003c930bb98c452b62ba70d35517

SHA512
991cfa4a2505656642e6aae46b89057d9a25d7e8573064d7124fe8ab32a0fbbe3c18d3e431ee75fd6453b3ffc8a47e714fc852b27d2a547da7b362077c5a7f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
554B

MD5
3583f2f5649529db0669dd4ed76440d2

SHA1
fbe9c7047d0fa9e4123ecc04d9b4ac0fa17543d6

SHA256
fbf995d83a2d7e57d751b7720bb56a8c3b0a835907de5986e9be3cf426f1851f

SHA512
3a52772ef8090c70dc26623a2e5ebb403e9c9171b831e4cbeed102b6bc69507b5f78961b8ce0d4a67410e6984baff771a43c02296ab368b5be04e2012ec189b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
c5fcf3083f055d1d9ffa3a24122ff899

SHA1
4a2ff322d97d6cf8f25a381fdadf0ed044f7e9fc

SHA256
4105b62e9d0ca0eee279a4fc41d3e2072fa53d09bf0bb3d2284aacdf192a5cfb

SHA512
c69a3db9bfee384ec8b322cfcce469eb9ecdcaeccf81bfb3dac44c0ac6a411c6ad828a22fd377926c63f472ff7698ff5bd7dec52d6547dac4bf9aefb3e2e05f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
248B

MD5
13a8438c91b18702b7cd3c0ce62c50ee

SHA1
3705a21332c1246fd26ce30053ee6b1b91e6a692

SHA256
8972b8f0e4ce4971a779d0347a783ccca793b8a8a58ff8697dab90ce323ec444

SHA512
4b46eca20d88ebb035475886db12269a2818bf1e91c09dde37c0cabc149f4fcf6fde55b10879ef14edb6b42ad5f2eb39a71ef0027f90bf647159a364a75e8aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
248B

MD5
2f66cb99239d7f215131780e86bba7b0

SHA1
ea9707475caa279828f3306a6dd9671e4c5f8cab

SHA256
af9381e59b35addca583dce8a363b7409ee5e25128fbb1471573dc531e908c06

SHA512
9d29e78ef03a2f3851cf937f630fd6a24af3a644db8a0ee7b2a7378f193d19bca8bc818c7ca9f00f7f3088de0dec16cdb454426d5d4a259859befb305bceb66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51ce7fcb920132fa0ce5ee283d20bc33

SHA1
d904a2a4e4f1ec9b2dc559394623e9db27f6b536

SHA256
92623d7d7ece607d3889fcef981a3b0cf9fb5e534bbacfb818646d35f503b0e5

SHA512
00717539e27088cc6bcfa5e63db0a202d8c60cfb689b0f992ad975f7d22fa8164aa1e485f442deca2f489dba2862836725967000db038300b8b45ddb85a94f90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
645e22c02b5337f5abeea9dcedaf9744

SHA1
3e97bd40aeeff37111968621e1068f6f5dee214a

SHA256
ea421a9fd9804a78ff0114db470f745304e88a5ebab8e4301babfbaa9e0a4cf0

SHA512
fb47d72d6e04afed9a3b7492d8e6a42c1249b0043c7b8ed6cfb25ead632de6b05842566e828f7f1a87833589a1405f7cd313a42e822eb834b9a8646289decf12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e60f3656124f39058e930c6e7ec5c72

SHA1
bf011e488d9d889b0b6946b887f78d7fc4477941

SHA256
076dea0ba5df559e7887b82ee2942d3e701e54101ceab4984a2eb97cf8d0a1cc

SHA512
d6ec63e615909300b239fedb30c67a1be313e189eb8290296e4b8aa87cf207d8445ecd06f21260f883caaeafb8cf8af79eccd6cbab17bf6712b4c02a659326af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
98f7a2bad197538a6f1d7cba170fac56

SHA1
8c403cbc384f9c8d07ff16e95af86739c3f58b37

SHA256
75198fe2424bbd5803e1e091dae51eb8ee78323de125199776d2668f93ccd159

SHA512
00960fbf2efed8bb6a7701f1c0d084a30dc7e0ceea93d82297e6a76133ed23e85b0e3b49f35db1f0caae634134b6a586a4cd769c0295a78e025dbd61e6e0e39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13355943774127203

Filesize
1KB

MD5
bc5039dd004d2ac5aa8b694b3c885d58

SHA1
0e586a1f59f4fc6797216946cd2e801347b707f5

SHA256
993c574936baba94fa6abb574bbddc1a115893b679ece9dc45a09a56ca6bddab

SHA512
2a598588aa6f1351fd94b6146b59c951ece13974a75f6414d20fea419eb27da6654419e54e3818f0059f5598c81cd9846f9aa29744fb42fc735d5606e7e4eb4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13355943774473203

Filesize
1KB

MD5
0c333ead71692872015e834b275bb4b0

SHA1
32002a62fa83804b68554e5278f235aec5a70592

SHA256
2d949295f5a7cb77106e5a002519908854b30a5d0dea5cc25e24d141b2ed8457

SHA512
966c6fee9f79c17780b8d1258319a5bd0dccb758ec189f46eb837096fd12334fd3fb3118de304f182d5087ab0a867332cc5be9b5735532a6df35f64ed339f124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
bdae13f7fc90f8fc99bcd7d7d23f5ada

SHA1
8ba080168c5dc81a7d1c3fa3256848e8ac12ff6c

SHA256
c931735800418eafdfc7b602780c756807dd853844157a1b8123588e2a6dc31a

SHA512
6ecf0ab262f97df9e97a02ee968e69ba010bc5689c22813e554058292c4a15c1be38c8734ab1de5f82135a843f24a1d0929fe94724c828af09e719f98ddeb1d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
6d880b7e568f637cf96f81a2f720fb07

SHA1
85e6b1ccb5580fb434a1cce9e74d66f358657b6e

SHA256
7b9b60845eaa8660c258a7a4f38c6dd8444b0877238c47ed554878ca1e0f85d6

SHA512
64e087d341eb1fd6419c3214f6225adbf69a57d7b4f4b9276014254c38bd98971a284e2cb8519aacde1fd2b0cc7c894f35af7f26cba02a4f4ca248ea8db958c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
d4707ca33dfe36cdefa58863b7901cf2

SHA1
1acfcc52cc8a989c999e7b7a4f95ef6858e90c82

SHA256
fcee892e048019f2a167c1f35b7bf760ab8e4032e8cadde761753cc477cbf6c0

SHA512
30b256c18feb2996dfde484126ba147d5426cbd8b7233ba37bd9d4aee7da97d911df00a79658072e1d5b850c7117cab77df4a10edd03dd7716d2a2e472a16045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
e450b5cb24f44fb3cee8fd7e0f091b60

SHA1
3c9238b04763a81d0f617735794287a71a5c9139

SHA256
ef74eae1506d10d9cbf09835870a0ba1024fefd553b1b68f13a4f611b3db6865

SHA512
dae825a69b25930efeb69f27c59c6cb289372d1f2fcb42c4579582bc4931388f1c16464bd07fef90da75c611beb6b4b3eb6189f71e61261e1d315f959a511d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
3ea919bfad6d72095d27f26db9b011b7

SHA1
acd0d74ff2be608a518142cfa796869dd3a0034f

SHA256
da52ddca4f9bf2f6451e10455f217617c256774c900433af7ff320cdbed90708

SHA512
5132bd0f02dc21ce56b56e152f5810e3875f050dff4b7f6cb9f3edc67947f50dd900663622bdb9be7dd57f641323e36bed7f6fe82d1bf03dc8c57641762f655c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
c6442c2ae12210a078dfb3096beefc78

SHA1
6f0c12d79c4106246ec1840be5bb84d121e3b28e

SHA256
0af0e1cda2472926e92b586c827557a1194ab2256a1adbaf678aae2a6480a03d

SHA512
660208c60ee84c3488342015ade33528eda4d0381ab50a2f7fc5250ce0cd6ce599dcd4f4846eecb562fbee03832ec68b53a4022ccd65a80c6c4f048361aa062d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
f6ad48d65781dc4547768a78476626a9

SHA1
56640e6978724363548437c9878f29f12a11841b

SHA256
1b4090877812af69db86d74659802966e29d4fc165942b19f25f885b8dc38c7c

SHA512
751845b342604cc864ee93a646bc4467417bf70191e0db764f1ed2691f9c96bd8fd884cf5a32678d9d4a9e8ba05b62b725577ea74e246bcae5d151cfe394f4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
26995d2db66cd11eaf2fcb8132bf1dfb

SHA1
1436906409d3f115bd009f024e30e9e981f25499

SHA256
20d4bffdb4ddfd8b183d479e006362995eb464c21a2499401b101d7418fb5c41

SHA512
3e0845d6bf018301fb78128515c3e7a124ac517b4462828e12805b92c6ef4fa349fe39b5688c740dca0771372aac20f15cafdb8561c843395397e50ad5e08372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
e70796612df59e00844d1ea2efe08440

SHA1
878c56399dbbcd75486ca1ca8fd49b6f5faa1e87

SHA256
c3ab8fb0eca795cc93a7a772d3ec298c22e88833435a64375581a88dbdafc27c

SHA512
4a091784090d6ea50d704542e737753be7e9370302b7c13cdb980ca02cd9e4a4293341713d7928b9e2ff868587b288775fabd0b12b05054a4468c52935ff3b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
256KB

MD5
e1f2e7ad4b4c1e527ddd934959397f07

SHA1
97c8c2f116e9e980ee5fdcf7119cd43484d1e6c5

SHA256
2e2b723fdf4641baad0d261c8d3b07aa22491c7379cc7a2e3ce6c61be696b09d

SHA512
86f9c67ad1e9bea7047e1a95d1294e0cfcca107ccdeeb03be038c95be5ade8639561ca7a41aac0afbf0aed97498a8a8e88f6ec10c5cc7eb6d272a103581d205e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
576KB

MD5
3855d8b0b14d31cc7d4e4388d384a491

SHA1
724988af69989a01436d498dce2730e6846ef0e7

SHA256
e03f89bdaf9407d4c201b662aad9645c264b2bc665d68defc664abc8047b494e

SHA512
83b3c46f9d2e0a82542e3aabb938cbae8068caf3e0495fff565ae4af2cb41c0995ae7e3bcc8f310b805a2a92839d437ae46b0c49058688011af754483d86a438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
246be9c239e4890093d95859755c7355

SHA1
9a1ef126f295eab705e9767c627b97be34acaa6f

SHA256
f6418c3da0f059b92dbc614f563a5b9a9ffaf02847161c65b6442a7407c04129

SHA512
326ae6aef1158811a524e5dfd83b78b3a1d8409b1094d39c48d77388755e3a08dc5d86198180367f62e91cda380029fa75bba8792d7f85fe45af1589dc387be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7dea218f222596dc97147bf77e333d49

SHA1
49167632c5d0056e917e9f3c64b5bb6cdbb70aee

SHA256
6d58d5728dc89782837b34a5911eee85df45098f33f1a2ff5eb73cf52e44d784

SHA512
aea8f1fcce3831e3d813346e5698e86f385362a0544445863741cb7a72f7f750658375ea54bb2908acb5a7371dfdb18b009011ad07300aebf11349ce36e34cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a97764b2687c7f08502f46f1f40e85bf

SHA1
af07ac81c0ffda564c7715fbc8cf1a2e945dbe8b

SHA256
3adfbaa378c71d7820d77dc13de3f24f15db477a3384cd7ccdd5fec181afdfee

SHA512
0ca68b2b5c5347bfac86fdb539b178ea95ba078e94a3d1c784d605e99bf709a536d72b3d8154dd709632083e3f33b5f8cfbc8960df76a4638b82faf15f2778dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
c0af0b03765b4a03458743d620c8491b

SHA1
cc1e9b5cf85d1dbe9449740a3418f2ce05c8728d

SHA256
3bc292a46146d43be789e78b8db6ba816b41dd3c784a737cd98cc2b3dfcf2234

SHA512
443ee527d2572e39aff0382026f4b638fdd4635d4e28531d84efa552d034434b5be5c5ce9528240087d5403649d5a883fa6d577b53b66c0f6c2b180385b1573d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
70f7e86c4cf02852f589febc29fa8e10

SHA1
fe085e932df44268fe330746e1b34db98c8896ab

SHA256
2166bfbbef8d79be94d9c2f82fc08df4f96d7dd4f8ac93a56b0420c574a76c9b

SHA512
24f21eab0d0f59c924a9d1af96b4bc2d16bb2d4b1f10ef2a5f88d98ea955522a151a84394983dd2ad5aa3a5275f9198b254fbc487707519759534171b38a2a04

Download Submit
C:\Users\Admin\Desktop\xd.bat

Filesize
5B

MD5
88bbc1e216ca94c7388b302e934481d7

SHA1
de53dcaaea3a5d418225087905863028feac4c49

SHA256
24b1f1e77606f24873e5bb6ee4ce3a0dd75d419696a386a954ff01dfad2b21e2

SHA512
51d1cb1b064c6b109ec0a5284427c5321eb021265b68b1bbb81da7569332a50054b8376c43d323dcb8f1aaf429e682f327e8ad3350a1aadd9f57019eda8ac396

Download Submit
C:\Users\Admin\Desktop\xd.bat

Filesize
5B

MD5
3808d82ed52876c3dda66fbf4cb142c8

SHA1
224dcbc79590e1d4abfda3d17b083b333fa00980

SHA256
11ea65b2709bb714f059cf53767f7ee5ae6defe5b5d548e32375e65571b66015

SHA512
c29e6bca941260fa3109a4266d6ace8c88604135ac1785e8e77500e15cccf29565470dd09a78592d202d100376565eef5b70bb5eab5224931e0d6f831a7bfe61

Download Submit