hxxps://workupload[.]com/file/vqNjN2cXQ8K

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/vqNjN2cXQ8K

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5516	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
129	discord.com
130	discord.com
136	discord.com
140	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5748	NOTEPAD.EXE
6104	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
3192	msedge.exe
3192	msedge.exe
4772	identity_helper.exe
4772	identity_helper.exe
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 656	3192	msedge.exe	82
PID 3192 wrote to memory of 656	3192	msedge.exe	82
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 4124	3192	msedge.exe	83
PID 3192 wrote to memory of 1332	3192	msedge.exe	84
PID 3192 wrote to memory of 1332	3192	msedge.exe	84
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85
PID 3192 wrote to memory of 1152	3192	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/vqNjN2cXQ8K
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0f1e46f8,0x7ffa0f1e4708,0x7ffa0f1e4718
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3959641613360364246,16102748235133998731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:5784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5344

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\LEAK\tokens.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5748

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\LEAK\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LEAK\start.bat" "
1⤵
PID:2144
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar Discord-Token-Checker.jar
  2⤵
  PID:1320
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:5516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LEAK\start.bat" "
1⤵
PID:5924
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar Discord-Token-Checker.jar
  2⤵
  PID:5708
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\kernel-certs-debug4917.log
    3⤵
    PID:5936
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar C:\Users\Admin\AppData\Local\Temp\kernel-certs-debug4917.log
    3⤵
    PID:5592
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4348
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4616
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1644
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3664
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:336
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6140
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1608
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:896
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:528
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3092
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1512
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1980
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5180
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5084
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4948
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6108
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4412
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5544
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5524
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5420
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5472
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5548
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2144
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2180
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2176
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3152
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5368
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5616
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5668
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3492
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3360
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6016
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6040
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5772
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5752
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6064
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4528
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2408
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5152
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3356
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4344
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2400
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5452
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6136
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1668
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1840
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6020
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3944
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6116
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4452
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:448
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3672
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3780
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5916
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5484
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5196
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4272
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5664
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5680
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4288
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3164
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3804
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5980
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2680
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5748
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6072
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1620
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4656
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3552
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5024
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3996
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:880
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4848
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1836
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3272
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1744
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1780
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2704
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3656
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2348
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1812
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5448
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5528
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3480
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4676
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3088
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2248
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5508
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5384
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:468
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5440
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1320
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5144
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5624
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5672
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4304
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5764
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5176
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3704
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5096
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:856
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5460
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6088
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2364
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4456
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3828
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1452
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4328
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3892
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3916
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6024
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4484
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3476
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1596
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5156
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1848
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2168
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4108
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5184
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5260
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5232
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4404
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5920
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4324
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4352
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4436
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4856
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4488
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5140
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4824
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5228
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3112
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5076
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2676
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2468
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5312
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5320
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6100
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3820
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3236
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5940
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2496
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2016
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2424
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1440
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3160
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2228
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1772
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4900
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4796
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4340
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4648
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3264
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5512
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5248
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2148
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5256
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5264
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:236
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:3040
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:4332
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:2760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5728
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:232
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5404
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1296
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5124
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5724
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:840
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5976
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:6028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:1392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cls
    3⤵
    PID:5756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
87a240af28867b428ca4bb0810e43b51

SHA1
1d82ad1cd26a94fee5485bd33dbb19c3d2ee19a9

SHA256
d497d6103f6a612be84ffd8cf8f4a0dd6ff26a9a01a169bb7e0721a7e0986532

SHA512
a3f41198632d5614b516ed96977d2bc6f79039461ae85f3a13451f35d0f3466ab9f902e0dbcadaab9144efa36f06f07250284d3726d6f75d13a485da4473214a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\90b3a548-6471-4b9a-8b83-e8338d874e44.tmp

Filesize
11KB

MD5
34bd52252f148a3f841e2f76095afa88

SHA1
20995ef457c5fd3635510d545cff59587ed11e8e

SHA256
b15770fe89b2bb3a59a878175131ec46e71379748fa2494f3ed53286c371a38e

SHA512
1154cc0d5dfdaf277b3f453c510a6755d7284334a68648bf89f3e46fc7b931e9923455616abffa1581fb28adf3b8cf67ebd4d8616b0b520c6a16c059810d9fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
37KB

MD5
27eec7e8f48ac0d64e62ec535a19ed37

SHA1
0454ae16951154ff4d64dc2dd20f780b6da87ee8

SHA256
9107d29b79f5c0e9d7ac88f893e0afb7c672d536b2e41de469172c8b7366e3d0

SHA512
f93033661c1974d9225b7e05543d7efe62574567abf7bdbb982b36e5b0be658937a7128de10376f9e39c20a2d40688862fa0e76aa53b0b8c87b99ee536fbb175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
18KB

MD5
a0d1c0e87d4aab152935f291da880680

SHA1
911ca914c16e56c3335258332750b088753c9f37

SHA256
48c3d0abbc64bc2c72ad90f5328dfe4144b02045695dda4aef4428de8281a4a7

SHA512
af1c607f9a518ffdeda6ce8c43cc3c9cb01a01b862aea90e599d67f1a51bb3734fbc1fc09f972bfbb8bee03349bb74a735feb4673734704412affff93b869d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
50KB

MD5
9a93901bb6ec6209354e1be372ae8eae

SHA1
4b1d90ad40072ba06a1b79dfd8747cdc4b1d6932

SHA256
70fecffa1922dbf4166c58e06fd328b8ebf87bc29bb3cc639da612fbee854b17

SHA512
79289c3bf155545fc474ada8992731a31f6a3caa49100f3498013540c9fe2c169b4837fa5e40b97566a0fe570c23723f9baa27f613852b2aac2d235cb7393798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
29KB

MD5
a942aab3fb4f7bf4e9e8e5fce8a7703b

SHA1
72dee9fb0a71b50fee698521b7303ef2a8d945b3

SHA256
a28d47a15441be2cbf4e19be272deaa8022c6feedf82f4360385ad18d7294aa3

SHA512
8570fe9925107cb74060a2fdc0efef369297457af2197c283a4a5c7c9ac72c5c002a026e3e4d5ea0f65f8b7865060b9d679c549cd45d181b337bcf580a31d3b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
19KB

MD5
856a3daa268de8801e7cfd5b727b6de2

SHA1
8e099b433518980e657c7541c49b498e6b83430d

SHA256
b870ae3c5216311e1dd7b8662e01d1fa3326edc85a98a58247cd37b8cfca0be5

SHA512
2f191ea906a3551576ab14e607fdde9930fcb15f15ffb40a8c5999ba07224bbb8ea69918db11d1cd719a3d57510edd466ad2b9199c6a45a48463b0020a2e6eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c26d697b6a0bd426ca346bf750561b88

SHA1
fe6304239b38839c89c82da04e031fac7160e9f2

SHA256
145d11ec602e5aba407154f4b1b2e50ef9da32c860c377683153d263db89464c

SHA512
0c2401c448ba43aabe0e5dbcf0153db6a3af9c5f35050694d9dc144d9bf17705a1fda7ab812ed25cf181c83021a59c1417bc83d8f6c381167b9bd1f41a3c4360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f4e1ae247b6e231b219643796eeef10d

SHA1
778e3a63fa08c43b7d6227688349e9a30c0e88b5

SHA256
5b750954540b97e6588ae0387e6b429a50a52787b2457dd5a9e7302c25688d5c

SHA512
9b01d25dda80e5754397b95d2b6699c36dced2ef2dffe9c2b54dc5b995837fbf782ec8ae088c12ba22bb762bf78dbee311b33a1b385204e9ae76ee73cd119b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aef261b050cef56c305623fcb28dcaa6

SHA1
14880b45a007c4570db357f6afbb6a02f3ef0e7f

SHA256
37b770c384984cbc686f7fa9d2ff9935bd406b7690dd1ecf0b1730a582c3c93a

SHA512
cc9c272632f75072d41bf01ed5b39c876ba06ca268084a92d292e410c07fdf3cfc7975223d41a2b2c5e638811b28aecd84ae484edc6a1f1c32e31cdb57707a99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fcaa21783c9ad0ec1be4c3a63e2ea6d7

SHA1
ad79bc9bafeeaee4854a84173b19ca019ece090c

SHA256
4b78ae61ac6c18f5eed01102b40c96fe64120e1f5296031a84aa0d4e76d6205c

SHA512
ed96b7a00d0b66e2bb19072e89bcdb7373d4ba202cddb6fd5567ad0391e01081c89b3479e0335e683707a02a3ad1863366de844aba2fde42f5d5e5e62b49bb35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c8180395ef9d033d8a956b5f5fea6f55

SHA1
8bd4f17bd27c1d59d7cb704cebb6233048616d11

SHA256
50d0d15b30038dcf76a5ce7dec9678ffb95c74db8df4b269f1858ffc4e3720bd

SHA512
a8b4392e347e14595825e425e821c416be48d0de9fb59c9d6a1a0277e55200d23044700f84df1eedfb0d3b05f0ee77bea88cfdb06ed0c7b33601c50a66087ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a4ae4c09d584e5b21a8b792229f4d0b

SHA1
18faf6b7ec5ff90971f15a5861dadb99dbe47da0

SHA256
3dfbc67895dc5a97b08d317b87ee669f18abf1957bb410250acb8a184994ce36

SHA512
5c73d3be71110d91d24aa103f23b0a44c03b5ab145db505c78a8c94f5aaff06f1752d0f768833eb22067a920d076e6b250bb8490671fd649fe8447dd392f69ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\kernel-certs-debug4917.log

Filesize
1KB

MD5
518d2beba469ad5f6f3b8be557f7ac22

SHA1
96b01888418b25c0efdc2f2e857513af978adea9

SHA256
47331f6ff6f1c0e14e9e312adc7d986b76c506b25a1e247b2c2e93fb03bca15a

SHA512
b42c6e57d2773772074a38138b0c6aadeb0bb5bf047be6d7b5f4906336ffee584375b6dbc44ae3ac72a1968081e9f9342105b07c81381e9a99d11d552b4f18f8

Download Submit
C:\Users\Admin\Downloads\LEAK.zip

Filesize
2.4MB

MD5
1b03fb2fff99a30c3117f154b38977e2

SHA1
584be67f611ad99e0f9e64e7ea2de5853afd983a

SHA256
99fbae6c058b88942180276547978801158197e3fc7b044b87482c628e63a85f

SHA512
79db186076d06150956d7a549e05116da739b0556ad64cc921c4f53580d4f578bc45f66b0a5b89454ae5012f70e97e528c4e2a6e28a19e76da99fcc3ae580f8a

Download Submit
memory/1320-307-0x0000029D6CF40000-0x0000029D6CF41000-memory.dmp

Filesize
4KB

Download
memory/5708-328-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-372-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-378-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-368-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-435-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-437-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-443-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-445-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-462-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-465-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-470-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-474-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download
memory/5708-476-0x000001EA3CE50000-0x000001EA3CE51000-memory.dmp

Filesize
4KB

Download