e056bf730fa3b5a1016610b2b6469847b3e1b1abc7d9d5333292d45a08d003e5

Analysis

max time kernel
3s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Size

15KB
MD5

25697dce0ad0b6f399e79dd60861445a
SHA1

85b3022a9ce4538e67f19d497fb95730792b2814
SHA256

e056bf730fa3b5a1016610b2b6469847b3e1b1abc7d9d5333292d45a08d003e5
SHA512

ed5f525ff6092f1b451e58caa0e6c364a673a6840cf7f6102329729c8f4f0ec489f6cb2d5f9d8bc5ccc40079a224e10a8d13df6bc326612058d5ac46993500d7
SSDEEP

384:Iu76MjMOilLoRGkT3a2E+u+9kH+b/hIskuVoGfKzH:mdOilLoBTK9GkH+kuiGfW

Score

8^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 10 IoCs

pid	Process
1824	lpmxajkl.exe
6500	lpmxajkl.exe
7076	lpmxajkl.exe
5972	lpmxajkl.exe
6056	lpmxajkl.exe
6680	lpmxajkl.exe
7132	lpmxajkl.exe
7008	lpmxajkl.exe
8580	lpmxajkl.exe
7912	lpmxajkl.exe

Installs/modifies Browser Helper Object 2 TTPs 20 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27AC9076-C898-B098-D098-A18319080972}\ = "nhmxbjkl.dll"	lpmxajkl.exe

Drops file in System32 directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lpmxajkl.exe	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\rnmxajkl.sys	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File opened for modification	C:\Windows\SysWOW64\lpmxajkl.exe	lpmxajkl.exe
File created	C:\Windows\SysWOW64\nhmxbjkl.dll	lpmxajkl.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmxajkl.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ThreadingModel = "Apartment"	lpmxajkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AC9076-C898-B098-D098-A18319080972}\InprocServer32\ = "C:\\Windows\\SysWow64\\nhmxbjkl.dll"	lpmxajkl.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
1824	lpmxajkl.exe
1824	lpmxajkl.exe
6500	lpmxajkl.exe
6500	lpmxajkl.exe
7076	lpmxajkl.exe
7076	lpmxajkl.exe
5972	lpmxajkl.exe
5972	lpmxajkl.exe
6056	lpmxajkl.exe
6056	lpmxajkl.exe
6680	lpmxajkl.exe
6680	lpmxajkl.exe
7132	lpmxajkl.exe
7132	lpmxajkl.exe
7008	lpmxajkl.exe
7008	lpmxajkl.exe
8580	lpmxajkl.exe
8580	lpmxajkl.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
Token: SeDebugPrivilege	1824	lpmxajkl.exe
Token: SeDebugPrivilege	6500	lpmxajkl.exe
Token: SeDebugPrivilege	7076	lpmxajkl.exe
Token: SeDebugPrivilege	5972	lpmxajkl.exe
Token: SeDebugPrivilege	6056	lpmxajkl.exe
Token: SeDebugPrivilege	6680	lpmxajkl.exe
Token: SeDebugPrivilege	7132	lpmxajkl.exe
Token: SeDebugPrivilege	7008	lpmxajkl.exe
Token: SeDebugPrivilege	8580	lpmxajkl.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4256	1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe	84
PID 1816 wrote to memory of 4256	1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe	84
PID 1816 wrote to memory of 4256	1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe	84
PID 1816 wrote to memory of 1824	1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe	86
PID 1816 wrote to memory of 1824	1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe	86
PID 1816 wrote to memory of 1824	1816	25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe	86
PID 1824 wrote to memory of 4260	1824	lpmxajkl.exe	87
PID 1824 wrote to memory of 4260	1824	lpmxajkl.exe	87
PID 1824 wrote to memory of 4260	1824	lpmxajkl.exe	87
PID 1824 wrote to memory of 6500	1824	lpmxajkl.exe	89
PID 1824 wrote to memory of 6500	1824	lpmxajkl.exe	89
PID 1824 wrote to memory of 6500	1824	lpmxajkl.exe	89
PID 6500 wrote to memory of 6528	6500	lpmxajkl.exe	90
PID 6500 wrote to memory of 6528	6500	lpmxajkl.exe	90
PID 6500 wrote to memory of 6528	6500	lpmxajkl.exe	90
PID 6500 wrote to memory of 7076	6500	lpmxajkl.exe	92
PID 6500 wrote to memory of 7076	6500	lpmxajkl.exe	92
PID 6500 wrote to memory of 7076	6500	lpmxajkl.exe	92
PID 7076 wrote to memory of 7052	7076	lpmxajkl.exe	93
PID 7076 wrote to memory of 7052	7076	lpmxajkl.exe	93
PID 7076 wrote to memory of 7052	7076	lpmxajkl.exe	93
PID 7076 wrote to memory of 5972	7076	lpmxajkl.exe	95
PID 7076 wrote to memory of 5972	7076	lpmxajkl.exe	95
PID 7076 wrote to memory of 5972	7076	lpmxajkl.exe	95
PID 5972 wrote to memory of 5948	5972	lpmxajkl.exe	96
PID 5972 wrote to memory of 5948	5972	lpmxajkl.exe	96
PID 5972 wrote to memory of 5948	5972	lpmxajkl.exe	96
PID 5972 wrote to memory of 6056	5972	lpmxajkl.exe	98
PID 5972 wrote to memory of 6056	5972	lpmxajkl.exe	98
PID 5972 wrote to memory of 6056	5972	lpmxajkl.exe	98
PID 6056 wrote to memory of 2304	6056	lpmxajkl.exe	99
PID 6056 wrote to memory of 2304	6056	lpmxajkl.exe	99
PID 6056 wrote to memory of 2304	6056	lpmxajkl.exe	99
PID 6056 wrote to memory of 6680	6056	lpmxajkl.exe	101
PID 6056 wrote to memory of 6680	6056	lpmxajkl.exe	101
PID 6056 wrote to memory of 6680	6056	lpmxajkl.exe	101
PID 6680 wrote to memory of 540	6680	lpmxajkl.exe	102
PID 6680 wrote to memory of 540	6680	lpmxajkl.exe	102
PID 6680 wrote to memory of 540	6680	lpmxajkl.exe	102
PID 6680 wrote to memory of 7132	6680	lpmxajkl.exe	104
PID 6680 wrote to memory of 7132	6680	lpmxajkl.exe	104
PID 6680 wrote to memory of 7132	6680	lpmxajkl.exe	104
PID 7132 wrote to memory of 6952	7132	lpmxajkl.exe	105
PID 7132 wrote to memory of 6952	7132	lpmxajkl.exe	105
PID 7132 wrote to memory of 6952	7132	lpmxajkl.exe	105
PID 7132 wrote to memory of 7008	7132	lpmxajkl.exe	107
PID 7132 wrote to memory of 7008	7132	lpmxajkl.exe	107
PID 7132 wrote to memory of 7008	7132	lpmxajkl.exe	107
PID 7008 wrote to memory of 7028	7008	lpmxajkl.exe	108
PID 7008 wrote to memory of 7028	7008	lpmxajkl.exe	108
PID 7008 wrote to memory of 7028	7008	lpmxajkl.exe	108
PID 7008 wrote to memory of 8580	7008	lpmxajkl.exe	110
PID 7008 wrote to memory of 8580	7008	lpmxajkl.exe	110
PID 7008 wrote to memory of 8580	7008	lpmxajkl.exe	110
PID 8580 wrote to memory of 8544	8580	lpmxajkl.exe	111
PID 8580 wrote to memory of 8544	8580	lpmxajkl.exe	111
PID 8580 wrote to memory of 8544	8580	lpmxajkl.exe	111
PID 8580 wrote to memory of 7912	8580	lpmxajkl.exe	113
PID 8580 wrote to memory of 7912	8580	lpmxajkl.exe	113
PID 8580 wrote to memory of 7912	8580	lpmxajkl.exe	113

C:\Users\Admin\AppData\Local\Temp\25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25697dce0ad0b6f399e79dd60861445a_JaffaCakes118.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623046.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4256
- C:\Windows\SysWOW64\lpmxajkl.exe
  C:\Windows\system32\lpmxajkl.exe
  2⤵
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623343.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
- - C:\Windows\SysWOW64\lpmxajkl.exe
    C:\Windows\system32\lpmxajkl.exe
    3⤵
    - Executes dropped EXE
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623593.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:6528
  - - C:\Windows\SysWOW64\lpmxajkl.exe
      C:\Windows\system32\lpmxajkl.exe
      4⤵
      Executes dropped EXE
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:7076
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624125.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
    - - C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        5⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5972
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624375.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
      - C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        6⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624562.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        7⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624734.bat
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        8⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:7132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625046.bat
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        9⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:7008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625265.bat
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        10⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:8580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625453.bat
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:8544
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625750.bat
        12⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        12⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625953.bat
        13⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        13⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626140.bat
        14⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        14⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626421.bat
        15⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        15⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626578.bat
        16⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        16⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626890.bat
        17⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        17⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627109.bat
        18⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        18⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627375.bat
        19⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        19⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627625.bat
        20⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        20⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627875.bat
        21⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        21⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628093.bat
        22⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        22⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628406.bat
        23⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        23⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628640.bat
        24⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        24⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628921.bat
        25⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        25⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629203.bat
        26⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        26⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629515.bat
        27⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        27⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629796.bat
        28⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        28⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630093.bat
        29⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        29⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630359.bat
        30⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        30⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630593.bat
        31⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        31⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630812.bat
        32⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        32⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631015.bat
        33⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        33⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631328.bat
        34⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        34⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631578.bat
        35⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        35⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631812.bat
        36⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        36⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632046.bat
        37⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        37⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632234.bat
        38⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        38⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632453.bat
        39⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        39⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632765.bat
        40⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        40⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633078.bat
        41⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        41⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633328.bat
        42⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        42⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633656.bat
        43⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        43⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633937.bat
        44⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        44⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634187.bat
        45⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        45⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634468.bat
        46⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        46⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634718.bat
        47⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        47⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634937.bat
        48⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        48⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635265.bat
        49⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        49⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635562.bat
        50⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        50⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635812.bat
        51⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        51⤵
        
        PID:660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636109.bat
        52⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        52⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636390.bat
        53⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        53⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636640.bat
        54⤵
        
        PID:848
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        54⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636828.bat
        55⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        55⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637109.bat
        56⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        56⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637406.bat
        57⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        57⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637656.bat
        58⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        58⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637875.bat
        59⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        59⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638406.bat
        60⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        60⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638734.bat
        61⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        61⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638968.bat
        62⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        62⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639125.bat
        63⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        63⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639375.bat
        64⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        64⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639593.bat
        65⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        65⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639750.bat
        66⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        66⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640015.bat
        67⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        67⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640203.bat
        68⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        68⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640406.bat
        69⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        69⤵
        
        PID:18700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640578.bat
        70⤵
        
        PID:18728
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        70⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640937.bat
        71⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        71⤵
        
        PID:15204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641125.bat
        72⤵
        
        PID:15184
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        72⤵
        
        PID:18644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641296.bat
        73⤵
        
        PID:18684
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        73⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641593.bat
        74⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        74⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641890.bat
        75⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        75⤵
        
        PID:18772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642140.bat
        76⤵
        
        PID:16944
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        76⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642437.bat
        77⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        77⤵
        
        PID:15616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642671.bat
        78⤵
        
        PID:15640
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        78⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642781.bat
        79⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        79⤵
        
        PID:15040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643187.bat
        80⤵
        
        PID:15072
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        80⤵
        
        PID:17816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643437.bat
        81⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        81⤵
        
        PID:14212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643671.bat
        82⤵
        
        PID:14084
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        82⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643890.bat
        83⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        83⤵
        
        PID:18468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644109.bat
        84⤵
        
        PID:18476
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        84⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644312.bat
        85⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        85⤵
        
        PID:14928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644515.bat
        86⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        86⤵
        
        PID:17964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644734.bat
        87⤵
        
        PID:19440
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        87⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644953.bat
        88⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        88⤵
        
        PID:15600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645328.bat
        89⤵
        
        PID:15576
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        89⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646187.bat
        90⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        90⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646796.bat
        91⤵
        
        PID:14912
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        91⤵
        
        PID:15692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647000.bat
        92⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        92⤵
        
        PID:18904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647187.bat
        93⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        93⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647578.bat
        94⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        94⤵
        
        PID:17756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647828.bat
        95⤵
        
        PID:17912
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        95⤵
        
        PID:17468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648093.bat
        96⤵
        
        PID:17104
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        96⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648328.bat
        97⤵
        
        PID:14488
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        97⤵
        
        PID:14572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648546.bat
        98⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        98⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648890.bat
        99⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        99⤵
        
        PID:15316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649234.bat
        100⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        100⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650656.bat
        101⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        101⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651031.bat
        102⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        102⤵
        
        PID:15224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652875.bat
        103⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        103⤵
        
        PID:16708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653171.bat
        104⤵
        
        PID:17292
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        104⤵
        
        PID:16440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653437.bat
        105⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        105⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653703.bat
        106⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        106⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654000.bat
        107⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        107⤵
        
        PID:13944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654312.bat
        108⤵
        
        PID:17500
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        108⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654578.bat
        109⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        109⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654812.bat
        110⤵
        
        PID:18568
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        110⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655109.bat
        111⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        111⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655656.bat
        112⤵
        
        PID:14952
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        112⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655875.bat
        113⤵
        
        PID:15352
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        113⤵
        
        PID:15064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656140.bat
        114⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        114⤵
        
        PID:14748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656562.bat
        115⤵
        
        PID:16120
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        115⤵
        
        PID:13624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656937.bat
        116⤵
        
        PID:17372
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        116⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657312.bat
        117⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        117⤵
        
        PID:19180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657640.bat
        118⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        118⤵
        
        PID:14740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657984.bat
        119⤵
        
        PID:15944
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        119⤵
        
        PID:19104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658406.bat
        120⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        120⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658687.bat
        121⤵
        
        PID:15736
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        121⤵
        
        PID:17728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659062.bat
        122⤵
        
        PID:16324
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        122⤵
        
        PID:18952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659453.bat
        123⤵
        
        PID:15284
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        123⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659750.bat
        124⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        124⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660046.bat
        125⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        125⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660437.bat
        126⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        126⤵
        
        PID:16684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660718.bat
        127⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        127⤵
        
        PID:19236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661062.bat
        128⤵
        
        PID:15308
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        128⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661390.bat
        129⤵
        
        PID:15708
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        129⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661796.bat
        130⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        130⤵
        
        PID:18616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662281.bat
        131⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        131⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662843.bat
        132⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        132⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663218.bat
        133⤵
        
        PID:19452
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        133⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663500.bat
        134⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        134⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663906.bat
        135⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        135⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664328.bat
        136⤵
        
        PID:16504
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        136⤵
        
        PID:16000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664828.bat
        137⤵
        
        PID:18104
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        137⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665171.bat
        138⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        138⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665484.bat
        139⤵
        
        PID:18352
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        139⤵
        
        PID:17904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665812.bat
        140⤵
        
        PID:15960
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        140⤵
        
        PID:17828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666203.bat
        141⤵
        
        PID:15092
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        141⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666453.bat
        142⤵
        
        PID:16596
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        142⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666812.bat
        143⤵
        
        PID:16700
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        143⤵
        
        PID:19280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667171.bat
        144⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        144⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667453.bat
        145⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        145⤵
        
        PID:14344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667937.bat
        146⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        146⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668140.bat
        147⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        147⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668718.bat
        148⤵
        
        PID:18296
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        148⤵
        
        PID:18512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669000.bat
        149⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        149⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669265.bat
        150⤵
        
        PID:952
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        150⤵
        
        PID:17936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669531.bat
        151⤵
        
        PID:15168
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        151⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669843.bat
        152⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        152⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670187.bat
        153⤵
        
        PID:14964
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        153⤵
        
        PID:17716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670453.bat
        154⤵
        
        PID:17228
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        154⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670796.bat
        155⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        155⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671125.bat
        156⤵
        
        PID:16696
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        156⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671390.bat
        157⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        157⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671796.bat
        158⤵
        
        PID:17204
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        158⤵
        
        PID:20280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672171.bat
        159⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        159⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672562.bat
        160⤵
        
        PID:19892
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        160⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672828.bat
        161⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        161⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673109.bat
        162⤵
        
        PID:17040
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        162⤵
        
        PID:16560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673500.bat
        163⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\lpmxajkl.exe
        
        C:\Windows\system32\lpmxajkl.exe
        163⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673890.bat
        164⤵
        
        PID:16928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674031.bat
        164⤵
        
        PID:17168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674203.bat
        163⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674250.bat
        161⤵
        
        PID:16408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674265.bat
        160⤵
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674390.bat
        155⤵
        
        PID:15448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674421.bat
        154⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674437.bat
        153⤵
        
        PID:15656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674500.bat
        152⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674609.bat
        151⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674625.bat
        150⤵
        
        PID:17288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674656.bat
        149⤵
        
        PID:18640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674687.bat
        148⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674750.bat
        147⤵
        
        PID:14136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674781.bat
        146⤵
        
        PID:16396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674812.bat
        145⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674875.bat
        144⤵
        
        PID:20340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674921.bat
        143⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675000.bat
        142⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675046.bat
        140⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675109.bat
        138⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675250.bat
        133⤵
        
        PID:16348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675265.bat
        132⤵
        
        PID:15212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675312.bat
        131⤵
        
        PID:17760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675328.bat
        130⤵
        
        PID:17684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675359.bat
        129⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675406.bat
        127⤵
        
        PID:16660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675453.bat
        126⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675484.bat
        125⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675640.bat
        121⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675671.bat
        120⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675718.bat
        119⤵
        
        PID:19328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675765.bat
        118⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675796.bat
        117⤵
        
        PID:20424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675812.bat
        116⤵
        
        PID:20420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675828.bat
        115⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675843.bat
        114⤵
        
        PID:20332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675906.bat
        113⤵
        
        PID:19624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675984.bat
        111⤵
        
        PID:16292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676000.bat
        110⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676078.bat
        109⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676203.bat
        108⤵
        
        PID:560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676250.bat
        107⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676265.bat
        106⤵
        
        PID:18388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676281.bat
        105⤵
        
        PID:18332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676359.bat
        103⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676390.bat
        102⤵
        
        PID:20460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676515.bat
        98⤵
        
        PID:16764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676546.bat
        97⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676578.bat
        96⤵
        
        PID:19196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676609.bat
        95⤵
        
        PID:17388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676640.bat
        94⤵
        
        PID:20096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676640.bat
        93⤵
        
        PID:19744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676703.bat
        92⤵
        
        PID:18152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676750.bat
        91⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676765.bat
        90⤵
        
        PID:15896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240676156.bat
        89⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675890.bat
        88⤵
        
        PID:20040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240675453.bat
        87⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674859.bat
        84⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674609.bat
        83⤵
        
        PID:15620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674515.bat
        82⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240674218.bat
        81⤵
        
        PID:19840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673734.bat
        79⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240673312.bat
        78⤵
        
        PID:15164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672875.bat
        76⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672750.bat
        75⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672421.bat
        74⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240672140.bat
        73⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671843.bat
        72⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671750.bat
        71⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671515.bat
        70⤵
        
        PID:19848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240671140.bat
        69⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670906.bat
        68⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670671.bat
        67⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670609.bat
        66⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670328.bat
        65⤵
        
        PID:18008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240670125.bat
        64⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669906.bat
        63⤵
        
        PID:14116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669703.bat
        62⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669531.bat
        61⤵
        
        PID:19408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240669328.bat
        60⤵
        
        PID:16588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668906.bat
        59⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668468.bat
        58⤵
        
        PID:15460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240668296.bat
        57⤵
        
        PID:20184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667968.bat
        56⤵
        
        PID:15544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667781.bat
        55⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667406.bat
        54⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667265.bat
        53⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667046.bat
        52⤵
        
        PID:17088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666812.bat
        51⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666546.bat
        50⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666140.bat
        49⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665796.bat
        48⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665468.bat
        47⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665250.bat
        46⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665000.bat
        45⤵
        
        PID:16104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664781.bat
        44⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664546.bat
        43⤵
        
        PID:15536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664218.bat
        42⤵
        
        PID:19364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663906.bat
        41⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663718.bat
        40⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663265.bat
        39⤵
        
        PID:18044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240663031.bat
        38⤵
        
        PID:14384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662812.bat
        37⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662765.bat
        36⤵
        
        PID:15076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662421.bat
        35⤵
        
        PID:18588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240662109.bat
        34⤵
        
        PID:16648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661890.bat
        33⤵
        
        PID:19300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661671.bat
        32⤵
        
        PID:18200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661453.bat
        31⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661156.bat
        30⤵
        
        PID:19140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660812.bat
        29⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660812.bat
        28⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660265.bat
        27⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660093.bat
        26⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659750.bat
        25⤵
        
        PID:17888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659468.bat
        24⤵
        
        PID:19420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659265.bat
        23⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658984.bat
        22⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658718.bat
        21⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658484.bat
        20⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658187.bat
        19⤵
        
        PID:14092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658000.bat
        18⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657671.bat
        17⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657500.bat
        16⤵
        
        PID:13536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657218.bat
        15⤵
        
        PID:18416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656984.bat
        14⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656703.bat
        13⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656531.bat
        12⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656453.bat
        11⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656156.bat
        10⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655984.bat
        9⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655640.bat
        8⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655390.bat
        7⤵
        
        PID:10168
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655171.bat
        6⤵
        
        PID:14228
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655093.bat
        5⤵
        
        PID:5692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654828.bat
      4⤵
      PID:8868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654171.bat
    3⤵
    PID:18436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653906.bat
  2⤵
  PID:7680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFD240623046.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD240655093.bat

Filesize
121B

MD5
e2410165cfb71f41e262ace67aa489b3

SHA1
7ebda74ae4c41de41ab77f72fe22b495e0f4774a

SHA256
e85f536411b2829abe369ec288582508db5c63902a60b43263acd5ab1ca468e0

SHA512
fa1c25703837a067146c6b1c4be3762b5d3efa00e72867199772171205302549213c31b5b141ceb8a87b57711f07cd1d2b10d504e6eada42ef125a9906939617

Download Submit
C:\Windows\SysWOW64\lpmxajkl.exe

Filesize
15KB

MD5
25697dce0ad0b6f399e79dd60861445a

SHA1
85b3022a9ce4538e67f19d497fb95730792b2814

SHA256
e056bf730fa3b5a1016610b2b6469847b3e1b1abc7d9d5333292d45a08d003e5

SHA512
ed5f525ff6092f1b451e58caa0e6c364a673a6840cf7f6102329729c8f4f0ec489f6cb2d5f9d8bc5ccc40079a224e10a8d13df6bc326612058d5ac46993500d7

Download Submit
C:\Windows\SysWOW64\nhmxbjkl.dll

Filesize
523KB

MD5
6b88f76af22b77366ea5a908173852cb

SHA1
f438e9a8d6c729e257556dc4ff9a2c159598308b

SHA256
4c6e1c612fad89f9b51d18ba1cc9b264f8a18b7c37c59e23528348dc135b2891

SHA512
24388aecec1fe76f65abff9012be357bb44a0622e0c638cfb38265ca67147ded59a321f66d50ea8910472b54e5e272fe818081531cbaa33b91538b6ae1c2f461

Download Submit
C:\Windows\SysWOW64\nhmxbjkl.dll

Filesize
351KB

MD5
3e068cfc929427dcd6f8fbaf0d51765f

SHA1
99a300f4ccd38b955cff6801132c2f9ff445b46b

SHA256
0a4f7e558e8e260db5a1282e284337e91be84ab6f9d356dce845ca8b0acb4c64

SHA512
e58afb0899eb77960ba22a5df3450ba3542271cba590d3351e8966904c2b6baee28b4ad9d6f082a94d7497ad550023e22a2a2d3ea3d42c8a764a7eb4ac802448

Download Submit
C:\Windows\SysWOW64\nhmxbjkl.dll

Filesize
523KB

MD5
9a71ab2db0e70c008b19e266daa946d8

SHA1
8178bb7241801dc668ccd1e5655f2d3ecdadcf34

SHA256
9a83f9aad7677f5e755ba1fdfc5bec9c7000e128525b5882ce2f459bf3f3ac1d

SHA512
ae3a4cbfec3e4ee36a68bf9276532dbead27201344ce25d411c7893352021db02d205be425101a9c3199046a24dd1a2429968452ab15d4ed29a9c607a459ffb9

Download Submit
C:\Windows\SysWOW64\rnmxajkl.sys

Filesize
520B

MD5
c8ee317de55cac0aa9a26ebef55520ab

SHA1
1f6d1afe1d01dd7e694a416f131c9f6e91eac947

SHA256
cd45d7c41fa2150a22752e936a5bddfeeaf5ab8521d4b5ec571ddf19867af4bf

SHA512
79c229bbc070763c690a3b04d770c4cf6a55debcfd642ea7ee5dab7421a5d10cefe8f3c8336799df23a5976e8f25dbd9e23f627b4ec8c0872481f15ef23a5e2d

Download Submit
memory/1816-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1816-10140-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1824-1023-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5112-164996-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

Filesize
2.0MB

Download
memory/7076-3398-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/10080-60677-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/10968-161829-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/17760-164972-0x00000000005A0000-0x00000000005FA000-memory.dmp

Filesize
360KB

Download
memory/17904-164931-0x00000000770A0000-0x000000007717C000-memory.dmp

Filesize
880KB

Download
memory/20332-164989-0x00000000005A0000-0x00000000005FA000-memory.dmp

Filesize
360KB

Download