59e0d867b86061445e269a2099ed3b09dd9b8f471ba5a77bacafc230e126ab4a

Analysis

max time kernel
2s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Size

15KB
MD5

6786f6f4461107902a9d6ebb8d672755
SHA1

b02b24e92eac765edd77208ca414648024439b37
SHA256

59e0d867b86061445e269a2099ed3b09dd9b8f471ba5a77bacafc230e126ab4a
SHA512

19c76f8bb090bfff7922bc5c1eb9224a3d17762325a606ab12aa07ab63a6a6efeee9312f80ea65f8faa0cbd06299c8aa20fcbe6365667ab195c5fbf6760ec6ac
SSDEEP

384:ISV76FphKbSjIUznK4lFuhA9en0zQgkOeVnDny:rAPS/f4vZHQDM

Score

7^/10

adware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
7104	lkssaplo.exe
540	lkssaplo.exe
7372	lkssaplo.exe
11348	lkssaplo.exe
7028	lkssaplo.exe
1664	lkssaplo.exe
11256	lkssaplo.exe
10112	lkssaplo.exe
10996	lkssaplo.exe
12328	lkssaplo.exe
5648	lkssaplo.exe

Installs/modifies Browser Helper Object 2 TTPs 22 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}\ = "lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B69874A-C58C-458D-69F0-698F874E41B2}	lkssaplo.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File created	C:\Windows\SysWOW64\lkssaplo.exe	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\fassaplo.sys	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lkssaplo.exe	lkssaplo.exe
File created	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lkssaplo.exe
File opened for modification	C:\Windows\SysWOW64\lassaplo.dll	lkssaplo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7264	15116	WerFault.exe	691

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\lassaplo.dll"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32\ThreadingModel = "Apartment"	lkssaplo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B69874A-C58C-458D-69F0-698F874E41B2}\InprocServer32	lkssaplo.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
7104	lkssaplo.exe
7104	lkssaplo.exe
540	lkssaplo.exe
540	lkssaplo.exe
7372	lkssaplo.exe
7372	lkssaplo.exe
11348	lkssaplo.exe
11348	lkssaplo.exe
7028	lkssaplo.exe
7028	lkssaplo.exe
1664	lkssaplo.exe
1664	lkssaplo.exe
11256	lkssaplo.exe
11256	lkssaplo.exe
10112	lkssaplo.exe
10112	lkssaplo.exe
10996	lkssaplo.exe
10996	lkssaplo.exe
12328	lkssaplo.exe
12328	lkssaplo.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
Token: SeDebugPrivilege	7104	lkssaplo.exe
Token: SeDebugPrivilege	540	lkssaplo.exe
Token: SeDebugPrivilege	7372	lkssaplo.exe
Token: SeDebugPrivilege	11348	lkssaplo.exe
Token: SeDebugPrivilege	7028	lkssaplo.exe
Token: SeDebugPrivilege	1664	lkssaplo.exe
Token: SeDebugPrivilege	11256	lkssaplo.exe
Token: SeDebugPrivilege	10112	lkssaplo.exe
Token: SeDebugPrivilege	10996	lkssaplo.exe
Token: SeDebugPrivilege	12328	lkssaplo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 4732	1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe	84
PID 1056 wrote to memory of 4732	1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe	84
PID 1056 wrote to memory of 4732	1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe	84
PID 1056 wrote to memory of 7104	1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe	86
PID 1056 wrote to memory of 7104	1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe	86
PID 1056 wrote to memory of 7104	1056	6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe	86
PID 7104 wrote to memory of 7144	7104	lkssaplo.exe	87
PID 7104 wrote to memory of 7144	7104	lkssaplo.exe	87
PID 7104 wrote to memory of 7144	7104	lkssaplo.exe	87
PID 7104 wrote to memory of 540	7104	lkssaplo.exe	89
PID 7104 wrote to memory of 540	7104	lkssaplo.exe	89
PID 7104 wrote to memory of 540	7104	lkssaplo.exe	89
PID 540 wrote to memory of 1684	540	lkssaplo.exe	90
PID 540 wrote to memory of 1684	540	lkssaplo.exe	90
PID 540 wrote to memory of 1684	540	lkssaplo.exe	90
PID 540 wrote to memory of 7372	540	lkssaplo.exe	92
PID 540 wrote to memory of 7372	540	lkssaplo.exe	92
PID 540 wrote to memory of 7372	540	lkssaplo.exe	92
PID 7372 wrote to memory of 7396	7372	lkssaplo.exe	93
PID 7372 wrote to memory of 7396	7372	lkssaplo.exe	93
PID 7372 wrote to memory of 7396	7372	lkssaplo.exe	93
PID 7372 wrote to memory of 11348	7372	lkssaplo.exe	95
PID 7372 wrote to memory of 11348	7372	lkssaplo.exe	95
PID 7372 wrote to memory of 11348	7372	lkssaplo.exe	95
PID 11348 wrote to memory of 11376	11348	lkssaplo.exe	96
PID 11348 wrote to memory of 11376	11348	lkssaplo.exe	96
PID 11348 wrote to memory of 11376	11348	lkssaplo.exe	96
PID 11348 wrote to memory of 7028	11348	lkssaplo.exe	98
PID 11348 wrote to memory of 7028	11348	lkssaplo.exe	98
PID 11348 wrote to memory of 7028	11348	lkssaplo.exe	98
PID 7028 wrote to memory of 7060	7028	lkssaplo.exe	99
PID 7028 wrote to memory of 7060	7028	lkssaplo.exe	99
PID 7028 wrote to memory of 7060	7028	lkssaplo.exe	99
PID 7028 wrote to memory of 1664	7028	lkssaplo.exe	101
PID 7028 wrote to memory of 1664	7028	lkssaplo.exe	101
PID 7028 wrote to memory of 1664	7028	lkssaplo.exe	101
PID 1664 wrote to memory of 3496	1664	lkssaplo.exe	102
PID 1664 wrote to memory of 3496	1664	lkssaplo.exe	102
PID 1664 wrote to memory of 3496	1664	lkssaplo.exe	102
PID 1664 wrote to memory of 11256	1664	lkssaplo.exe	104
PID 1664 wrote to memory of 11256	1664	lkssaplo.exe	104
PID 1664 wrote to memory of 11256	1664	lkssaplo.exe	104
PID 11256 wrote to memory of 6668	11256	lkssaplo.exe	105
PID 11256 wrote to memory of 6668	11256	lkssaplo.exe	105
PID 11256 wrote to memory of 6668	11256	lkssaplo.exe	105
PID 11256 wrote to memory of 10112	11256	lkssaplo.exe	107
PID 11256 wrote to memory of 10112	11256	lkssaplo.exe	107
PID 11256 wrote to memory of 10112	11256	lkssaplo.exe	107
PID 10112 wrote to memory of 10144	10112	lkssaplo.exe	108
PID 10112 wrote to memory of 10144	10112	lkssaplo.exe	108
PID 10112 wrote to memory of 10144	10112	lkssaplo.exe	108
PID 10112 wrote to memory of 10996	10112	lkssaplo.exe	110
PID 10112 wrote to memory of 10996	10112	lkssaplo.exe	110
PID 10112 wrote to memory of 10996	10112	lkssaplo.exe	110
PID 10996 wrote to memory of 11028	10996	lkssaplo.exe	111
PID 10996 wrote to memory of 11028	10996	lkssaplo.exe	111
PID 10996 wrote to memory of 11028	10996	lkssaplo.exe	111
PID 10996 wrote to memory of 12328	10996	lkssaplo.exe	113
PID 10996 wrote to memory of 12328	10996	lkssaplo.exe	113
PID 10996 wrote to memory of 12328	10996	lkssaplo.exe	113
PID 12328 wrote to memory of 12372	12328	lkssaplo.exe	114
PID 12328 wrote to memory of 12372	12328	lkssaplo.exe	114
PID 12328 wrote to memory of 12372	12328	lkssaplo.exe	114
PID 12328 wrote to memory of 5648	12328	lkssaplo.exe	116

C:\Users\Admin\AppData\Local\Temp\6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6786f6f4461107902a9d6ebb8d672755_JaffaCakes118.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620421.bat
  2⤵
  PID:4732
- C:\Windows\SysWOW64\lkssaplo.exe
  C:\Windows\system32\lkssaplo.exe
  2⤵
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:7104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620609.bat
    3⤵
    PID:7144
- - C:\Windows\SysWOW64\lkssaplo.exe
    C:\Windows\system32\lkssaplo.exe
    3⤵
    - Executes dropped EXE
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620828.bat
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\lkssaplo.exe
      C:\Windows\system32\lkssaplo.exe
      4⤵
      Executes dropped EXE
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:7372
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621109.bat
        5⤵
        
        PID:7396
    - - C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        5⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:11348
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621359.bat
        6⤵
        
        PID:11376
      - C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        6⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:7028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621609.bat
        7⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        7⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621828.bat
        8⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        8⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:11256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622140.bat
        9⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        9⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:10112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622375.bat
        10⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        10⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:10996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622625.bat
        11⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        11⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:12328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622828.bat
        12⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623093.bat
        13⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        13⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623375.bat
        14⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        14⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623640.bat
        15⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        15⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623890.bat
        16⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        16⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624171.bat
        17⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        17⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624406.bat
        18⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        18⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624671.bat
        19⤵
        
        PID:13692
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        19⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624921.bat
        20⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        20⤵
        
        PID:16084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625203.bat
        21⤵
        
        PID:16112
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        21⤵
        
        PID:14096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625453.bat
        22⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        22⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625750.bat
        23⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        23⤵
        
        PID:16868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626000.bat
        24⤵
        
        PID:16904
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        24⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626296.bat
        25⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        25⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626593.bat
        26⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        26⤵
        
        PID:16484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626906.bat
        27⤵
        
        PID:16508
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        27⤵
        
        PID:15252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627203.bat
        28⤵
        
        PID:15276
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        28⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627531.bat
        29⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        29⤵
        
        PID:15912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627796.bat
        30⤵
        
        PID:15948
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        30⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628109.bat
        31⤵
        
        PID:15068
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        31⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628406.bat
        32⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        32⤵
        
        PID:15848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629468.bat
        33⤵
        
        PID:15888
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        33⤵
        
        PID:14992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629734.bat
        34⤵
        
        PID:15076
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        34⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630296.bat
        35⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        35⤵
        
        PID:15788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630578.bat
        36⤵
        
        PID:15820
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        36⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630968.bat
        37⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        37⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631203.bat
        38⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        38⤵
        
        PID:17284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631500.bat
        39⤵
        
        PID:17264
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        39⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631875.bat
        40⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        40⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632125.bat
        41⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        41⤵
        
        PID:16240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632312.bat
        42⤵
        
        PID:17356
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        42⤵
        
        PID:14604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632531.bat
        43⤵
        
        PID:14596
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        43⤵
        
        PID:17980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632828.bat
        44⤵
        
        PID:18004
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        44⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633250.bat
        45⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        45⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633640.bat
        46⤵
        
        PID:17360
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        46⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633875.bat
        47⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        47⤵
        
        PID:19056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634140.bat
        48⤵
        
        PID:18900
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        48⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634453.bat
        49⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        49⤵
        
        PID:16928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634703.bat
        50⤵
        
        PID:16540
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        50⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635093.bat
        51⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        51⤵
        
        PID:20024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635375.bat
        52⤵
        
        PID:19988
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        52⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635562.bat
        53⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        53⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635968.bat
        54⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        54⤵
        
        PID:14176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636296.bat
        55⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        55⤵
        
        PID:20152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636765.bat
        56⤵
        
        PID:20200
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        56⤵
        
        PID:16348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637031.bat
        57⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        57⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637359.bat
        58⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        58⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637687.bat
        59⤵
        
        PID:17436
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        59⤵
        
        PID:14804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638062.bat
        60⤵
        
        PID:14776
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        60⤵
        
        PID:15548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638437.bat
        61⤵
        
        PID:17372
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        61⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638750.bat
        62⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        62⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639062.bat
        63⤵
        
        PID:15320
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        63⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639375.bat
        64⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        64⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639765.bat
        65⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        65⤵
        
        PID:15324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640109.bat
        66⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        66⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640359.bat
        67⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        67⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640593.bat
        68⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        68⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640984.bat
        69⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        69⤵
        
        PID:17596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641234.bat
        70⤵
        
        PID:17676
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        70⤵
        
        PID:14908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641484.bat
        71⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        71⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641781.bat
        72⤵
        
        PID:17064
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        72⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642218.bat
        73⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        73⤵
        
        PID:18576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642515.bat
        74⤵
        
        PID:18568
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        74⤵
        
        PID:16528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642765.bat
        75⤵
        
        PID:16688
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        75⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643109.bat
        76⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        76⤵
        
        PID:19788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643484.bat
        77⤵
        
        PID:19172
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        77⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643687.bat
        78⤵
        
        PID:14968
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        78⤵
        
        PID:16764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643968.bat
        79⤵
        
        PID:17348
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        79⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644281.bat
        80⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        80⤵
        
        PID:20260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644609.bat
        81⤵
        
        PID:20920
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        81⤵
        
        PID:14608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644796.bat
        82⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        82⤵
        
        PID:16592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645187.bat
        83⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        83⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645421.bat
        84⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        84⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645671.bat
        85⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        85⤵
        
        PID:15988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646015.bat
        86⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        86⤵
        
        PID:19592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646250.bat
        87⤵
        
        PID:17464
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        87⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646468.bat
        88⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        88⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646734.bat
        89⤵
        
        PID:17216
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        89⤵
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647171.bat
        90⤵
        
        PID:19316
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        90⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647468.bat
        91⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        91⤵
        
        PID:14636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647656.bat
        92⤵
        
        PID:244
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        92⤵
        
        PID:19564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647906.bat
        93⤵
        
        PID:18924
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        93⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648296.bat
        94⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        94⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648609.bat
        95⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        95⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648812.bat
        96⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        96⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649140.bat
        97⤵
        
        PID:14448
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        97⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649343.bat
        98⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        98⤵
        
        PID:21372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649640.bat
        99⤵
        
        PID:18816
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        99⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649937.bat
        100⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        100⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650203.bat
        101⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        101⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650484.bat
        102⤵
        
        PID:16900
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        102⤵
        
        PID:17160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650937.bat
        103⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        103⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651265.bat
        104⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        104⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651593.bat
        105⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        105⤵
        
        PID:20300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652000.bat
        106⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        106⤵
        
        PID:15184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652312.bat
        107⤵
        
        PID:19876
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        107⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652734.bat
        108⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        108⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653093.bat
        109⤵
        
        PID:19344
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        109⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653437.bat
        110⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        110⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653765.bat
        111⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        111⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654062.bat
        112⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        112⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654578.bat
        113⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        113⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654890.bat
        114⤵
        
        PID:18908
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        114⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655359.bat
        115⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        115⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656000.bat
        116⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        116⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656500.bat
        117⤵
        
        PID:15224
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        117⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656765.bat
        118⤵
        
        PID:14184
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        118⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657203.bat
        119⤵
        
        PID:20756
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        119⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657593.bat
        120⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        120⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657937.bat
        121⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        121⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658218.bat
        122⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        122⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658593.bat
        123⤵
        
        PID:20056
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        123⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659062.bat
        124⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        124⤵
        
        PID:17864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659437.bat
        125⤵
        
        PID:16016
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        125⤵
        
        PID:216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659843.bat
        126⤵
        
        PID:13348
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        126⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660265.bat
        127⤵
        
        PID:15900
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        127⤵
        
        PID:18700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660625.bat
        128⤵
        
        PID:21300
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        128⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660890.bat
        129⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        129⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661359.bat
        130⤵
        
        PID:15256
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        130⤵
        
        PID:18164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661718.bat
        131⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        131⤵
        
        PID:20372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662031.bat
        132⤵
        
        PID:18852
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        132⤵
        
        PID:17876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662359.bat
        133⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        133⤵
        
        PID:13920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662812.bat
        134⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        134⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663171.bat
        135⤵
        
        PID:14772
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        135⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663515.bat
        136⤵
        
        PID:17248
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        136⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663968.bat
        137⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        137⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664468.bat
        138⤵
        
        PID:17316
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        138⤵
        
        PID:20012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664859.bat
        139⤵
        
        PID:20660
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        139⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665265.bat
        140⤵
        
        PID:18472
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        140⤵
        
        PID:19856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665546.bat
        141⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        141⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665906.bat
        142⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        142⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666312.bat
        143⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        143⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666609.bat
        144⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        144⤵
        
        PID:15388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667015.bat
        145⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        145⤵
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667359.bat
        146⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        146⤵
        
        PID:14700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667656.bat
        147⤵
        
        PID:16224
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        147⤵
        
        PID:20592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668187.bat
        148⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        148⤵
        
        PID:19956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668718.bat
        149⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        149⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669218.bat
        150⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        150⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669468.bat
        151⤵
        
        PID:20656
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        151⤵
        
        PID:17124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669703.bat
        152⤵
        
        PID:17980
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        152⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670046.bat
        153⤵
        
        PID:17272
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        153⤵
        
        PID:20032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670421.bat
        154⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        154⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670703.bat
        155⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        155⤵
        
        PID:17312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671281.bat
        156⤵
        
        PID:18020
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        156⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671546.bat
        157⤵
        
        PID:19080
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        157⤵
        
        PID:15584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671890.bat
        158⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\lkssaplo.exe
        
        C:\Windows\system32\lkssaplo.exe
        158⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15116 -s 196
        159⤵
        Program crash
        
        PID:7264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674281.bat
        158⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674312.bat
        157⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674328.bat
        156⤵
        
        PID:14496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674359.bat
        155⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674390.bat
        154⤵
        
        PID:20788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674406.bat
        153⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674437.bat
        152⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674500.bat
        151⤵
        
        PID:13600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674531.bat
        150⤵
        
        PID:19624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674703.bat
        147⤵
        
        PID:19656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674765.bat
        145⤵
        
        PID:19992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674921.bat
        144⤵
        
        PID:16272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674968.bat
        143⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675031.bat
        142⤵
        
        PID:20280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675062.bat
        141⤵
        
        PID:21248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675109.bat
        139⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675140.bat
        138⤵
        
        PID:16220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675187.bat
        136⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675218.bat
        135⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675265.bat
        134⤵
        
        PID:18080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675328.bat
        133⤵
        
        PID:15808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675343.bat
        132⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675390.bat
        131⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675421.bat
        130⤵
        
        PID:15104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675468.bat
        129⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675718.bat
        121⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675765.bat
        120⤵
        
        PID:15636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675812.bat
        119⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676109.bat
        118⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676156.bat
        117⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676171.bat
        116⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676234.bat
        115⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676250.bat
        114⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676390.bat
        113⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676437.bat
        112⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676468.bat
        111⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676515.bat
        110⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676546.bat
        109⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676562.bat
        108⤵
        
        PID:15576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676593.bat
        107⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676593.bat
        106⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676609.bat
        105⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676640.bat
        104⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676671.bat
        103⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676750.bat
        102⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676812.bat
        101⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676843.bat
        100⤵
        
        PID:15340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676890.bat
        99⤵
        
        PID:14400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676906.bat
        98⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676921.bat
        97⤵
        
        PID:14384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676968.bat
        96⤵
        
        PID:18788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677015.bat
        95⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677484.bat
        91⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677578.bat
        90⤵
        
        PID:13556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677687.bat
        89⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240677406.bat
        88⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676984.bat
        87⤵
        
        PID:20536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676781.bat
        86⤵
        
        PID:20688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676562.bat
        85⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676218.bat
        84⤵
        
        PID:19888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676109.bat
        83⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675703.bat
        82⤵
        
        PID:15696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675265.bat
        81⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675015.bat
        80⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674687.bat
        79⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674500.bat
        78⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674203.bat
        77⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673984.bat
        76⤵
        
        PID:15432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673453.bat
        74⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673093.bat
        73⤵
        
        PID:19184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672796.bat
        72⤵
        
        PID:16968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672296.bat
        71⤵
        
        PID:14900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672015.bat
        70⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671765.bat
        69⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671656.bat
        68⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671203.bat
        67⤵
        
        PID:436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670953.bat
        66⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670734.bat
        65⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670453.bat
        64⤵
        
        PID:16844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670265.bat
        63⤵
        
        PID:18072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669875.bat
        62⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669375.bat
        61⤵
        
        PID:19900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669171.bat
        60⤵
        
        PID:17948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668656.bat
        59⤵
        
        PID:17736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668265.bat
        58⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668140.bat
        57⤵
        
        PID:19672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667718.bat
        56⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667406.bat
        55⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666812.bat
        54⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666687.bat
        53⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666125.bat
        52⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665968.bat
        51⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665812.bat
        50⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665281.bat
        49⤵
        
        PID:18892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665078.bat
        48⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664671.bat
        47⤵
        
        PID:20868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664343.bat
        46⤵
        
        PID:14972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664296.bat
        45⤵
        
        PID:20856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663828.bat
        44⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663593.bat
        43⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663234.bat
        42⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663015.bat
        41⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662812.bat
        40⤵
        
        PID:19912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662546.bat
        39⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662187.bat
        38⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661968.bat
        37⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661750.bat
        36⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661125.bat
        35⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661046.bat
        34⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660140.bat
        33⤵
        
        PID:15376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659968.bat
        32⤵
        
        PID:19920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658890.bat
        31⤵
        
        PID:17384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658765.bat
        30⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658406.bat
        29⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658296.bat
        28⤵
        
        PID:13560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657984.bat
        27⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657625.bat
        26⤵
        
        PID:14212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657234.bat
        25⤵
        
        PID:18392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656921.bat
        24⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656640.bat
        23⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656312.bat
        22⤵
        
        PID:16480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655984.bat
        21⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655765.bat
        20⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655453.bat
        19⤵
        
        PID:18296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655234.bat
        18⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655031.bat
        17⤵
        
        PID:16984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654937.bat
        16⤵
        
        PID:20272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654625.bat
        15⤵
        
        PID:17080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654312.bat
        14⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654015.bat
        13⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653718.bat
        12⤵
        
        PID:20488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653406.bat
        11⤵
        
        PID:14588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653093.bat
        10⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653000.bat
        9⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652718.bat
        8⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652562.bat
        7⤵
        
        PID:10020
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652234.bat
        6⤵
        
        PID:20044
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651953.bat
        5⤵
        
        PID:13536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651765.bat
      4⤵
      PID:10824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651546.bat
    3⤵
    PID:13584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651203.bat
  2⤵
  PID:13232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 15116 -ip 15116
1⤵
PID:19736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFD240622140.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD240651953.bat

Filesize
121B

MD5
fc4087a4c92c2259f567dfb94acef8f0

SHA1
6ec967393aa9b473e42bbade82fef92beec32210

SHA256
7e7f532c19fb1a4c377f245ad6ab781c961d9a75c755e3b632c0ed1f91c2ffa5

SHA512
fda573b5fbd11dee11b4ea889901868194ebcba7ab008f15d8dcebad3c9dd40296b91582ecbf92ad3a5991f4b77cfd7779b0875194ec3791e8bbde26261efb29

Download Submit
C:\Windows\SysWOW64\fassaplo.sys

Filesize
12KB

MD5
1a097a2cd2a29feb71b14233d89d0294

SHA1
917ae472b9c3669285e809899f7ba3ad0ecb204b

SHA256
50d94a6254b1482cbb1dcde485b3a23d53a65c732e824ea81995af060c59b5ce

SHA512
fe56fb8115ae0689bb7eb721d4dbbe70cad8d62da4fdc2b4e385d6f76ae3c719f7974a94b18f568a961598a7f34cd903774a6f3badbeb9f87a0c37a699ed4e0c

Download Submit
C:\Windows\SysWOW64\fassaplo.sys

Filesize
2KB

MD5
7340df01e3fa891ed74ecff3464b35cf

SHA1
3197d6b64d8983a83ce1e28315da1e5dc700ae45

SHA256
58be9f21795b41e04f75ea35d0f8ed3cdb2c8ce910297646d0573b3b9f293fa2

SHA512
4a0360a6a99d4982cddd851b6d9f00ba8d19c70602dd1667e02f694e45286f1cc3535ba82102797e7a70b7baf747a392aafbe6453e7ec70250804f136c970742

Download Submit
C:\Windows\SysWOW64\fassaplo.sys

Filesize
3KB

MD5
e331c167685941e6a5d16408a238976e

SHA1
6d9bd66c274bf8380fcb1e488ca09196299e072b

SHA256
2ebce58b5c0e6a7c2ee39f79d38adf8c7a979c52f01aacb7c9636c20881d5720

SHA512
7d492119d62a90a9715cc1f3e885e0a313ec61acf5a7c9aca1e806f96983862a66ae27ef6ffae6e6bd4e17fc6e03a8abc624e1fc87e66d1ff218244561003a43

Download Submit
C:\Windows\SysWOW64\fassaplo.sys

Filesize
3KB

MD5
298c7d1774c24969659cec6ca51f29f3

SHA1
bbb6e4a600d91c2b710b0256addd77e39c43912d

SHA256
f32d6c4685982d6c0673f4d7750d640012420b30a838b4bc1f31a32902c9addd

SHA512
fb1743edfca9f06c26e00f2f61cc41b519a7b4284585990b51180e05336605d8ff1c32871ea596192dbd42b940e3d994b1664a136ff4e498cecea5f102638231

Download Submit
C:\Windows\SysWOW64\fassaplo.sys

Filesize
4KB

MD5
ab5e6ca4e454a134817b629f719954b9

SHA1
02a08bc0bb1d39812b02af3fe0cba8f8a64e0ebb

SHA256
9bf41cbbda8953ac885551b3104154ac0959c2083f8ada0c91eb1503f3023fd1

SHA512
66322c5be7bad9de270241476225d69f0c9c2b15c2e910c19ab26256c0bd38a7c77075598490a70869478291cece936075e16ad6c415b0bf851df5313b251e2d

Download Submit
C:\Windows\SysWOW64\fassaplo.sys

Filesize
7KB

MD5
f5884b935c414de7d6a13dc4b94634f8

SHA1
7ce36c0c86244e859c166e74faa8cffbd9ff832a

SHA256
a4eb08ce9b12945ba5178024ce1e5ce051034aeaf095c5457c88052e355c4004

SHA512
6757afe16da47d2ada975231a987090ac8276874ab460538a2432f0f77ed5e1aae7bfa43fbccf4471b245f66eae079801df35a09dd41961c68379bb7264f05fa

Download Submit
C:\Windows\SysWOW64\lassaplo.dll

Filesize
63KB

MD5
7ddeef58c2154c56ee711da23b5298f6

SHA1
3bb525bbfcf9e71397880ed01a4661444390ef1f

SHA256
416e539791872172cb4c0fbdfa8433e69ed1e600b4319ae23aefd99a22cb63a4

SHA512
4e8118b8493967d07b4ec9796da647ab3ec9dcc676cc8c45998b55b77b252f59713cba4ac133936c08a5864424d4d13cabb06929035e171a3044eff68fba92fd

Download Submit
C:\Windows\SysWOW64\lassaplo.dll

Filesize
522KB

MD5
aa8abe1ac807b0b0665a525dfebbe057

SHA1
e7f0f700e48f34361bb7ca3a27e3bd4374bcd5f6

SHA256
6831ce10f1f6d6269038dd78c05bc2e96c0bb90835bf7edbb2991141a7f227c3

SHA512
b94ae886d4a90233b6c84c581eb6e2eb3a379b236dafd1a4a21a23ccd2852f7ff4e7ff14572f4814f62b6b26bf6ebcaf37fbe4d99ba4df4e132f91f221392da1

Download Submit
C:\Windows\SysWOW64\lkssaplo.exe

Filesize
15KB

MD5
6786f6f4461107902a9d6ebb8d672755

SHA1
b02b24e92eac765edd77208ca414648024439b37

SHA256
59e0d867b86061445e269a2099ed3b09dd9b8f471ba5a77bacafc230e126ab4a

SHA512
19c76f8bb090bfff7922bc5c1eb9224a3d17762325a606ab12aa07ab63a6a6efeee9312f80ea65f8faa0cbd06299c8aa20fcbe6365667ab195c5fbf6760ec6ac

Download Submit
memory/1056-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1056-39825-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2192-159420-0x0000000000560000-0x00000000005BA000-memory.dmp

Filesize
360KB

Download
memory/7104-31417-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/8420-159575-0x0000000000560000-0x00000000005BA000-memory.dmp

Filesize
360KB

Download
memory/15116-159409-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/16348-55842-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download