ratonrat | 6f56e69a061eb715f12fbc79b09e9c6994d5e4bc3c2c9872e804ad2623ac6f83

Analysis

user interaction
yes
max time kernel
332s
max time network
356s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
z.exe
Size 2.4MB
Sample260806-d82c7ssepd
SHA256 6f56e69a061eb715f12fbc79b09e9c6994d5e4bc3c2c9872e804ad2623ac6f83
MD5 eaed61d2723060a53fbac4dfe93e0318
SHA1 d477b352c4a9df1a4b10212aed2825f753f1ce3c
SHA512 b057eef0fcc6003df5219c485ccc7c157c90215f9d585ef621b9a09b180c2fc92a8a8c6b849725eab49f0659be395e0c23d0bbbd25c244085ad30529e0367b7f
SSDEEP 49152:O6gVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4RKR:BgVUuHjkDGjYQDGuRxzew
TLSH
T1D7C5016833F9860CF1BF0BF4A4B149664A72FC479D96D76C18A578DE04B6F44BA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution ratonrat stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

prinbeoffical-55650.portmap.host:55650

Mutex

5l2AHhYtAyxRd9atGT1O6Cl

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
true
password
t.me/junk_code
process_critical
false
raw
silly21
reconnect
3
startup
false
tag
Infected
uac
false
vm
false
website
https://google.com

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2624-1-0x0000024A53D50000-0x0000024A53FC6000-memory.dmp	family_ratonrat

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_78383461\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1853222279\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_78383461\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2808_974255949\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_244875360\_locales\es_419\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
11436	cmd.exe
1256	cmd.exe
14608	cmd.exe
16276	cmd.exe
19096	cmd.exe
10312	cmd.exe
12156	cmd.exe
18456	cmd.exe
16092	cmd.exe
19472	cmd.exe
11920	cmd.exe
24128	cmd.exe
24316	cmd.exe
7836	cmd.exe
8976	cmd.exe
13116	cmd.exe
13756	cmd.exe
15212	cmd.exe
19572	cmd.exe
3144	cmd.exe
12688	cmd.exe
15068	cmd.exe
15208	cmd.exe
19512	cmd.exe
20596	cmd.exe
16628	cmd.exe
25096	cmd.exe
9608	cmd.exe
19212	cmd.exe
23656	cmd.exe
15840	cmd.exe
7260	cmd.exe
21636	cmd.exe
14352	cmd.exe
14732	cmd.exe
22376	cmd.exe
9580	cmd.exe
11044	cmd.exe
20972	cmd.exe
8464	cmd.exe
13824	cmd.exe
6320	cmd.exe
7388	cmd.exe
13876	cmd.exe
16324	cmd.exe
22876	cmd.exe
23540	cmd.exe
1308	cmd.exe
9256	cmd.exe
12572	cmd.exe
15064	cmd.exe
23644	cmd.exe
23504	cmd.exe
21596	cmd.exe
17692	cmd.exe
20364	cmd.exe
1596	cmd.exe
21324	cmd.exe
14392	cmd.exe
19216	cmd.exe
20024	cmd.exe
21444	cmd.exe
24016	cmd.exe
14944	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3608	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304614061423261"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{E3641BB2-6073-4A27-B779-EB6D8A4E02A3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2624	z.exe
2624	z.exe
10604	msedge.exe
10604	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	z.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	z.exe
Token: SeShutdownPrivilege	25540	shutdown.exe
Token: SeRemoteShutdownPrivilege	25540	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2808	2624	z.exe	89
PID 2808 wrote to memory of 5688	2808	msedge.exe	90
PID 2808 wrote to memory of 3608	2808	msedge.exe	91
PID 2808 wrote to memory of 4352	2808	msedge.exe	92
PID 2808 wrote to memory of 4352	2808	msedge.exe	92
PID 2808 wrote to memory of 4352	2808	msedge.exe	92
PID 2808 wrote to memory of 2128	2808	msedge.exe	93
PID 2808 wrote to memory of 2128	2808	msedge.exe	93
PID 2808 wrote to memory of 4944	2808	msedge.exe	94
PID 2808 wrote to memory of 4944	2808	msedge.exe	94
PID 2808 wrote to memory of 4944	2808	msedge.exe	94
PID 2808 wrote to memory of 5144	2808	msedge.exe	95
PID 2808 wrote to memory of 5144	2808	msedge.exe	95
PID 2808 wrote to memory of 5144	2808	msedge.exe	95
PID 2808 wrote to memory of 2984	2808	msedge.exe	97
PID 2808 wrote to memory of 2984	2808	msedge.exe	97
PID 2808 wrote to memory of 2984	2808	msedge.exe	97
PID 2808 wrote to memory of 2020	2808	msedge.exe	98
PID 2808 wrote to memory of 2020	2808	msedge.exe	98
PID 2808 wrote to memory of 2020	2808	msedge.exe	98
PID 2808 wrote to memory of 4020	2808	msedge.exe	99
PID 2808 wrote to memory of 4020	2808	msedge.exe	99
PID 2808 wrote to memory of 3584	2808	msedge.exe	100
PID 2808 wrote to memory of 3584	2808	msedge.exe	100
PID 2808 wrote to memory of 3584	2808	msedge.exe	100
PID 2808 wrote to memory of 1896	2808	msedge.exe	102
PID 2808 wrote to memory of 4960	2808	msedge.exe	103
PID 2808 wrote to memory of 1896	2808	msedge.exe	102
PID 2808 wrote to memory of 4960	2808	msedge.exe	103
PID 2808 wrote to memory of 3220	2808	msedge.exe	105
PID 2808 wrote to memory of 5464	2808	msedge.exe	106
PID 2808 wrote to memory of 5464	2808	msedge.exe	106
PID 2808 wrote to memory of 4124	2808	msedge.exe	107
PID 2808 wrote to memory of 4124	2808	msedge.exe	107
PID 2808 wrote to memory of 3468	2808	msedge.exe	110
PID 2808 wrote to memory of 3468	2808	msedge.exe	110
PID 2808 wrote to memory of 4864	2808	msedge.exe	111
PID 2808 wrote to memory of 4864	2808	msedge.exe	111
PID 2808 wrote to memory of 4248	2808	msedge.exe	114
PID 2808 wrote to memory of 4128	2808	msedge.exe	115
PID 2808 wrote to memory of 4104	2808	msedge.exe	116
PID 2808 wrote to memory of 1916	2808	msedge.exe	117
PID 2808 wrote to memory of 1916	2808	msedge.exe	117
PID 2624 wrote to memory of 3220	2624	z.exe	121
PID 2624 wrote to memory of 2840	2624	z.exe	123
PID 2624 wrote to memory of 5772	2624	z.exe	125
PID 2624 wrote to memory of 1308	2624	z.exe	127
PID 2624 wrote to memory of 4104	2624	z.exe	129
PID 2624 wrote to memory of 4128	2624	z.exe	131
PID 2624 wrote to memory of 5604	2624	z.exe	133
PID 2624 wrote to memory of 2148	2624	z.exe	135
PID 2624 wrote to memory of 792	2624	z.exe	137
PID 2624 wrote to memory of 2780	2624	z.exe	139
PID 2624 wrote to memory of 4856	2624	z.exe	141
PID 2624 wrote to memory of 3048	2624	z.exe	143
PID 2624 wrote to memory of 5084	2624	z.exe	145
PID 2624 wrote to memory of 3760	2624	z.exe	147
PID 2624 wrote to memory of 3576	2624	z.exe	149
PID 2624 wrote to memory of 3348	2624	z.exe	151
PID 2624 wrote to memory of 1956	2624	z.exe	153
PID 2624 wrote to memory of 5664	2624	z.exe	155
PID 2624 wrote to memory of 6148	2624	z.exe	157
PID 2624 wrote to memory of 6208	2624	z.exe	159
PID 2624 wrote to memory of 6264	2624	z.exe	161

C:\Users\Admin\AppData\Local\Temp\z.exe
"C:\Users\Admin\AppData\Local\Temp\z.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffcee91c188,0x7ffcee91c194,0x7ffcee91c1a0
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,10906437550388291953,15521568424903433866,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,652201017052641636,10039102926488976028,262144 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,15125346091029029627,5180100814265159439,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,10451824749902100545,5366328392661785564,2097152 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3700,i,7071479943934119655,12279800226528592141,2097152 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,9767334118608773862,13564758036701531744,2097152 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,2102055738421684077,9394509321618551975,2097152 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,18126823889209736217,17215937370472576736,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5508,i,9771896051209575318,5237586223124775844,2097152 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,13510739987129998460,9426840550171124494,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,9417116823730574997,12237233424554378166,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,16671975920782304596,2614993145362653470,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,16671975920782304596,2614993145362653470,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,1322930617529883673,13675739892250604423,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,12371334078436281738,8639044852837461734,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,13332826060596929087,13849626448133428131,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,17650227553674432658,12667261994653608466,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,9021339731666287367,1081803353667535185,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,3340369644924797943,655689836091091009,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12855273196236537186,5537137325432126581,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,11591278679751040692,16905411186530745795,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,14672481034798862003,790477219826177674,262144 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:10604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,4398152960297660489,17812161964862943587,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:15632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,16628581707596727138,17518353545724266727,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:17212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,8453614756548028472,1979099341198981010,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
    3⤵
    PID:17220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,15909338900453941811,6376138611411322305,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
    3⤵
    PID:17332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,16300091284866368089,12103715799706171008,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:14
    3⤵
    PID:24292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,6154309224703687770,2329274473223230693,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:16128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4532966081033649812,16860041394682512733,524288 --field-trial-handle=2568,i,12817588493350765889,11404520408795279367,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:17016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:3220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:1308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:3760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:3576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:3348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:3300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:7836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:8464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:8976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:9256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:9608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:10312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:11436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:12156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:12572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:12688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:1256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:13116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:6320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:13756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:14608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:15068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:14392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:7388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:15208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:16276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:13876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:17692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:18456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:19096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:19216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:16324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:16092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:19212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:13824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:15212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:19512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:19572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:20024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:20364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:14732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:7260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:20596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:20972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:21324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:21444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:19472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:21636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:22376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:11920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:22876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:23540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:12700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:9684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:8516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:14352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:13420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:7012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:23644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:24016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:24128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:23504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:23656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:18288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:9580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:15668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:24316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:6344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:20668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:14300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:10672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:11044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:14944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:15840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:16628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:4012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:21496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:11692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:21596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:23896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:16612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:15064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:22392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:5060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:17440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:24996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:25064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  - Executes a command shell one-liner
  PID:25096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:25216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:25304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:25368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /r /f /t 0
  2⤵
  PID:25428
- - C:\Windows\system32\shutdown.exe
    Shutdown /r /f /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:25540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:25464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:25532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C pause
  2⤵
  PID:19172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5772

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3fb8055 /state1:0x41c64e6d
1⤵
PID:24432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:21980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c59bb697365f983b9da1c1dcfef74904521c9229a817b3d46a1a83aaa1c26687
MD5 19339b2c38a99b72a2e6fcb8bf48158f
SHA1 4bf4253c5f38ffd70f3c6e00eeb78c31c90ffbbb
SHA512 a3df49193bb8b3a586d27ff86d15b3f14e3f59ffc33b1bb359bf56d758e57ca6221b24623a8e53cc0f34f8e09bd58e4dffac29ada58ce16348334a7717887050
TLSH
T153E0208957C5C25D7601649F92D8570C93D07B1A9AC8FA1F1B44C44974C1044EB83E60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 57a86a3a9960c12efc5b22bf9133a517edfb6aca100b454063f78062a4c90ebd
MD5 222a53c3124b4c5566938ab70c3388c8
SHA1 5de0a14aba40436d2d8783d4a06db6aee4e8c9c4
SHA512 23f2c7c2542eba6ee858ab2345edda550c40a4f1ec9d8e1b0f5c0f54f0fe4873b06d0ba943f9086131d6bdf37cbefdb526124ec955729772fec705ebb6534573
TLSH
T17851D7B413B2C9D3C77587B317E25A4A36F0905B260B2E1A84643D719906F2DDCF101F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4783802f2f17b3f9f5035566a63bdcf912c3015892a36d78c851eee4a9c92887
MD5 5d8a8fc52c1656dc590826274de2554c
SHA1 78ac7306f30427812239614c8b7860cd49738d37
SHA512 b3e2872f275eb5162cb332336b3d84c106ee74c02868d02fe4ba72d6da803b623a8e03aab893659d3ba7c6fa6d48683833d3a5a729e42b28458c063fdebb3a11
SSDEEP 48:YALlhhhtNNmOhdhJhshCgyWzAsJJaCZs8Qzslfrs4zEsu/tsYLfo70EsYcszVBsq:DfPNgO33mAQjaAnNzYla0MnVu4K7ViwQ
TLSH
T15FB19DF7C3E9822D895156F49B157F2FCE1D0A24432C3D6AC8D8AE5B93E2472E101A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4d11be9e99f5e05669fdabe922eb6a498ca6b63b3ae8b900abfcfc8779b1899d
MD5 c657a0f7fb71c8c688d2d9fa050cf0ed
SHA1 cc836868272d8f98aae8b2fc0353296f7863772c
SHA512 f8b6c2e369d46e6240bba53121aac227b3af34eff667c27cdb6d36b22e407c95d3514c68321d7ee3b445bd3f8bf636ded3e57879e717ce1488968d8c30b4105b
SSDEEP 192:sxRnRLCk/fwsfG+9ZVHzoA8pjSb/g6+WN9yD/YoYNYdPGiIgDE8E0J:sxRngk/fwsfNzVu4/5m/i4Vj
TLSH
T17242D8066938AD3B6CC7D60DBA65BF53E2F9503360906E58A7FC961C10F76CD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 07aa8a6c419d5bf7a6b33a87224c0ad4507ca2c6b43292a73b7da598cffc7b63
MD5 12ddfa141054aa4eefa75e20161d484d
SHA1 509c97fb3a812cbcc5b19ec01d28f34f1692886b
SHA512 be2307ab42e3fe17e5e93b5067ec9bf8c468dc1f6e2a17d95f8d858259348583f683f4d46213a01ab7d371fbbdce338276fab4e6b69909d16ed80a0a0c74e598
SSDEEP 384:sxRngk/fwsf166s8qMpRiYnazAW8pZS15posJWeT+czVum/5m/j4Vj:sDgk/fz14Mnc7WeT+c7/58j4R
TLSH
T1E4C20805A924C83BAEC39D1C653D7E33DAEC505222C5DEDA56ECCA1C01AD1FDAB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bb54093f92f1092961e4a876b2f5733c46654c7c2cc6a71c9a2d5f3f98ee93ee
MD5 e50536511f217da07378b8d5bcfb06f6
SHA1 23fd1943d88949d2c189033314eacbd90a8b62ef
SHA512 082a3c7cf060dfe89919636be6c56e98e162d33d0a10ea23efa3f8d7933c5a926cff8095daf4514b015d4541249dade29e399ed9d7122fa0f467ddaf187f7cfb
SSDEEP 192:sxR4RLCk/fwsnswGazoA8pjSb/g6+WN9yD/YoXCYdPGiIgV4J:sxR4gk/fwsnspX4/5m/y4V2
TLSH
T16E42C6166928AD3B5CC7E21DBB65BF53D2F91032A1D46E58AAFC960C00F76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bdf054be0d788ba6802a63cbb10e8ab9d7cf113b39a2d65b728e15d18bf57c14
MD5 70bcd34451945a2e22d777a93407557a
SHA1 660e314326364aff3310095c23334aae52a91072
SHA512 a6f49d520ded3d6dfdce43ab24a2c91f672f6cae306a0bb5a6dbe9be06f434e5deb71d32bd786eb66dc578c079f4254d61808c11f27d977c585bc150af8b14ed
SSDEEP 192:sxRnRLCk/fwsfs9ZVHzoA8pjSb/g6+WN9yD/YoXNYdPGiIgDe8E0J:sxRngk/fwsfszVu4/5m/d4VJ
TLSH
T12642D7066938AD3BACC7D20DBB65BF53D2F95032A1D06E58A6FC961C04F76CD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 453306317f024271af79923ccd5e91b8788a62001127c3c23f0677fda90fb056
MD5 b24c33466eefb19da21076683335ed0b
SHA1 463ea4ed4376fb43eb568ee71260ed4af1616d51
SHA512 990b3aa3c71a1b2e5fbb16490b543bf49f6e5e76fb85768b7a9edc1e78729cedd0a3cfeea270363f7a9a3dbab69c021bf6b88cd4f85fa4cc28b6fd5c6605a59f
SSDEEP 768:j26HWo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVuwxro98e0Urw:j26HWUE7MRWgs2f02u1jak4wKLw
TLSH
T1D9C2DA7B740DCABF4F800ADDDC197E9B6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\947f6716-2b3f-4c7b-b889-f206c72a8acd\index-dir\the-real-index
Size 144B
SHA256 c7d8edce9c364185a0f2179ee47033edbedb770ebfc23b30e31da208d8d5caf7
MD5 352e443877d7418402661ef4e532c212
SHA1 7ca220a2790b529c9f3e5b62592c65cabc986657
SHA512 4f559dc9e2466e727189b45f6eb21ef90055266fe6e0144529b56c1500ce33b692b7cb687695688dedab9d563840c89fcade951f95534d66beecdcd4808f5629
TLSH
T173C09215CC1A9AA5C82F6131297761682B220AAC051AAE2A24DD6846A5A385CE0DA905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e083b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\947f6716-2b3f-4c7b-b889-f206c72a8acd\index-dir\the-real-index~RFe5e083b.TMP
Size 144B
SHA256 f6f5f86de114a77e9f9b73f3ccb76e45ef524ae816f543f394e6062a2be75072
MD5 66a0c0e52a6ba8ec563911bc590f6ca7
SHA1 92a31d3ee2bd381c3398d0683326f1f698e91bb9
SHA512 8e8695bf92fba696a5355d448d26b8a6eda8abab29a57983ce182fd852a5954d36437e1bca88ec3ea50405bf52a71d8c15c86edf26c512df1cbc4875cdb3a3b6
TLSH
T18DC01222C5538AB0C40B65701083821C23BB0C300021B76A70DD486F98F24C8D0D7A09
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 0e0ac4880fb4527c754d69e47bc5085015e49169e78c831ae394ea1c2262ac70
MD5 6740af6afd0e6994bd1962834b71cd3b
SHA1 bad24cefe95019c89b965d9c5c68f72ab532e73e
SHA512 572f98adb146360ab21d34e95dcfee29b7a0e0cf218ae9158cc0585a687e8661aab94f17e558c1ab14fd3e55eef3b55c28d9a219078bb200895ecca7d77adce1
TLSH
T10CE0D8F62DD73C14FCBF97EA147564980181B9649449EC8F251E96C760F22513896C25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9cb2efa4a8b3214ae96fddd2a150218e44ab2b4e902f9a937184542de629209e
MD5 48790b2ff107125e791bf888ab6f8497
SHA1 f6c52b81de2037d6dec7a8b2016b8c98cf6f47a7
SHA512 854fa0024837f62645c62957ca102ed25c410986940a048ea86d9901f28fbe8649450927e9f8b6f8fbd824626779660e1152fec18ad1a3e40e71c88d74d09ebd
TLSH
T17BB0120C14461C86C9505B710AC1008125B00D132902418301D0D156C0226008492418
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eed162612205200efda9bf3cc1444082ce9686044f6a629fe5526d76bedf433d
MD5 35a14838a65d33fec2566e684d6f0e87
SHA1 4e22ecdadd5bffc56e8f660d756ad5e5ef041457
SHA512 72cba612edb114306b60f842345a1e6f75f3eae87a694d865fc5c8b48ab90f1663478ece2ad736bdf405010ff47a66c278774ab4e78cfbb2711290e1610d8d7f
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgzi78gKB+R:C3gFB31lERe1JDggH2vHG5FaHoZs4q2l
TLSH
T1CA91F255727A03443C3EA61DC0A89D1BA68274737115652F7BE811A68FEBE028DFCCDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c6e6fce-fcb1-4ee5-9d55-def6f1a42429.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0c6e6fce-fcb1-4ee5-9d55-def6f1a42429.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4e4fd63d353ff439fd7661dbc94276dd2fa3d71ca42a4f8a3ca5920baeeaf207
MD5 7fd4c7699e1ea8fe6c46ec25e65fcd18
SHA1 a7b7e9ee7d0fdccaaedc4ad44afeff68bf8031f0
SHA512 5bf79ef7febb59708111463ab3663166057a2e17866e07a9059f9841fec85502c42199416574e96fa5e5929d6835365ba7c349334679440e55792391d9c39364
SSDEEP 768:YFQY31wg5U4xsOW8FsmyONXyer1IRCzni9G2ewBKZOWWOPx:7Y39LDdySIqnh2evZ5JPx
TLSH
T155039D75D865DE279CE6A7C6B7067343AEF410A3C5C89AE0EADD6F4D009329E030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ffb08a5934e66d4fe325491bfba6e405beb0a0de7c472cd21b122e96bef1c6bb
MD5 e21380ec3ab0d3c96b454491c0950a30
SHA1 38c817a9ef8816ff4b04cc3b18689abb82f88fcc
SHA512 fe9d10901b3485bef5ccea4eb9997ca3f612c7cc32154451d003534bc0e30757fc2fb76858c656265f3c7c25f695b613d12be7a80e8d8437f47df6756741cfbe
SSDEEP 768:p23zUH/TBOW8FsmwONXyer1IRCzni9G2ewBKZOWWOPx:p23zoadwSIqnh2evZ5JPx
TLSH
T15FF2AE70E469AD234CD5B389B6477343AEF82063E4C45B64EAEEAF1E019365E170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2b6974bd4ad6304976a40438ca3166b7e9a6b0a097e0c85c4045ff2bbac2821e
MD5 c8a29b867448b805ccec1ab658ce042e
SHA1 a55e252fb1fc751b51f17f873c2ed004025daec0
SHA512 93b390e5175f46ca825ec22290cf13f7596c434f602673a47d56dbd415017d66f2d2416980c191ae60fba559f8ee9a4671ea8b5964b32f9c9c00c8517a0c879b
SSDEEP 768:423sDH/TBOW8FsmwONXyer1IRCzni9G2ewBKZOWWOPx:423sDadwSIqnh2evZ5JPx
TLSH
T1ECF2AE70E469ED234CD5A389B64773836EF82063E4C45B64EAEEAF1E019365E170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 b874d4dbf401865c952c212ac7b7a79c5e699df147a69066704bd6844ecba5a3
MD5 71a0060078a44f945605d3305fc32a7a
SHA1 058c2310d1bad96f2277b2e6a092c080474f5d33
SHA512 626d092c24c39cbce2662c0b216f89566056ddf275b7f43532dac29c0010e91c8e2377b77b781e957d7bfbb4f34ef03ce435fb1b6964e4aef04972373c7a99c3
SSDEEP 768:YFof3/wgKF41sOW8FsmXONXyer1IRCzni9G2ewBKZOWWOPx:9f3ky3dXSIqnh2evZ5JPx
TLSH
T1ED1338F194D79D37D89E5387A33D6E429ABCD063B4888990BBD95E0DCC921BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1b09a3854422c7a4ba7bf4ea2bb08c1d8f57ba3ba9e74b1327e9767860dc6cab
MD5 3e765631ead4c96909caef23ed69e21b
SHA1 7d8092a47815b5c245a664d2d72b392efd1b1623
SHA512 f9b3e4f7ae96fa897aee83d0ef33fd80a65d55ab4e6b02e6e79ebe7e6b9a88d3adfc4b8bf1350b87b05f27e646ee0b8b0541debab95183dee4e6e7b1841e43dd
SSDEEP 768:hrv+4UNbdz3Y9/TBOW8FxONXyer1IRCzniBReVH1SK7:hbsbV3OaxSIqnCEH1l
TLSH
T1B103BE36E5A8DE338CE2A3C5B14B72037FB86057D6840B90E9DE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2a3ccf4-28c8-471f-b3d2-e07c114586a3.tmp

Path C:\Users\Admin\AppData\Local\Temp\c2a3ccf4-28c8-471f-b3d2-e07c114586a3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2808_1221021705\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-89-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-63-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-552-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-0-0x00007FFCEB4CF000-0x00007FFCEB4D0000-memory.dmp

Download

memory/2624-545-0x0000024A6EF20000-0x0000024A6EFD4000-memory.dmp

Download

memory/2624-537-0x0000024A6EDA0000-0x0000024A6EDD2000-memory.dmp

Download

memory/2624-88-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-528-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-64-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-543-0x0000024A6ED80000-0x0000024A6ED9A000-memory.dmp

Download

memory/2624-67-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-551-0x0000024A6EDE0000-0x0000024A6EE02000-memory.dmp

Download

memory/2624-685-0x0000024A6F330000-0x0000024A6F33E000-memory.dmp

Download

memory/2624-54-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-48-0x0000024A6E740000-0x0000024A6E74A000-memory.dmp

Download

memory/2624-530-0x0000024A6E910000-0x0000024A6E91A000-memory.dmp

Download

memory/2624-37-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-36-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-2-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-1-0x0000024A53D50000-0x0000024A53FC6000-memory.dmp

Download

memory/2624-773-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads