blankgrabber | 6b0fe7317b1449346dc037c38634b8703efc04e912d375531f2f4d1d284db591

Analysis

user interaction
yes
max time kernel
408s
max time network
407s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
906.exe
Size 73.0MB
Sample260806-q5b1cssfke
SHA256 6b0fe7317b1449346dc037c38634b8703efc04e912d375531f2f4d1d284db591
MD5 5a586d714e2f45907de739a30cf3162b
SHA1 521bcfafac4ccf982cf05089a970880c61717c29
SHA512 778427de1c7952464f9447e46feee5d68a23a45172835aa664d93c37b184b75e369eac095b7f47f6c5546872e38772d6396e71a1b08bd43f8e8495141aa46fe1
SSDEEP 1572864:6fjqEG0CBvgngQx8QcO7Ri3Y7gGYBPl19Gf21HbwIFiEB4E1:w80KvgMP38edGfWwCNz
TLSH
T1F9F733258441067FD8724332B9A1E111CD11FC2516B9CBB69FCD8789FE7B7E89832E89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution blankgrabber persistence pyinstaller stealer

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 26 IoCs

resource	yara_rule
behavioral1/memory/3032-328-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-334-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-337-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-356-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-359-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-364-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-367-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-370-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-373-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-376-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-379-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-382-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-385-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-427-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-473-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-592-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-595-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-598-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-601-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-604-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-607-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-610-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-615-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-639-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-642-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe
behavioral1/memory/3032-648-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp	blankgrabber_exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4584	powershell.exe
4496	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4716	InformerUpdate.exe
692	InformerUpdate.exe
680	InformerUpdate.exe
1264	InformerUpdate.exe
5024	SysSettingSvc.exe
3032	SysSettingSvc.exe

Loads dropped DLL 64 IoCs

pid	Process
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
5	api.ipify.org
7	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001b00000002b3c2-30.dat	pyinstaller

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
23656	Process not Found
20248	cmd.exe
26444	Process not Found
59616	Process not Found
24064	Process not Found
22088	Process not Found
19768	cmd.exe
12636	cmd.exe
28872	Process not Found
23608	Process not Found
20892	cmd.exe
27876	Process not Found
60216	Process not Found
24088	Process not Found
20432	cmd.exe
26332	Process not Found
23736	Process not Found
20756	cmd.exe
19648	cmd.exe
19348	cmd.exe
18652	cmd.exe
17796	cmd.exe
27520	Process not Found
26380	Process not Found
27576	Process not Found
26004	Process not Found
19092	cmd.exe
27496	Process not Found
23364	Process not Found
10644	cmd.exe
28212	Process not Found
22908	Process not Found
21164	cmd.exe
19600	cmd.exe
26252	Process not Found
60032	Process not Found
22876	Process not Found
8444	cmd.exe
17940	cmd.exe
7660	cmd.exe
2396	cmd.exe
2088	cmd.exe
29044	Process not Found
27136	Process not Found
20168	cmd.exe
5244	cmd.exe
26196	Process not Found
59792	Process not Found
59768	Process not Found
9120	Process not Found
20336	cmd.exe
20112	cmd.exe
9004	cmd.exe
4220	cmd.exe
28740	Process not Found
22684	Process not Found
28440	Process not Found
28308	Process not Found
24720	Process not Found
22884	Process not Found
20424	cmd.exe
18812	cmd.exe
8436	cmd.exe
27692	Process not Found

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304980056595598"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4080	906.exe
4080	906.exe
4080	906.exe
4080	906.exe
4584	powershell.exe
4584	powershell.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
4496	powershell.exe
4496	powershell.exe
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe
1668	chrome.exe
1668	chrome.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
1264	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe
692	InformerUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	SysSettingSvc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	906.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	692	InformerUpdate.exe
Token: SeDebugPrivilege	1264	InformerUpdate.exe
Token: SeDebugPrivilege	3032	SysSettingSvc.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeIncreaseQuotaPrivilege	4496	powershell.exe
Token: SeSecurityPrivilege	4496	powershell.exe
Token: SeTakeOwnershipPrivilege	4496	powershell.exe
Token: SeLoadDriverPrivilege	4496	powershell.exe
Token: SeSystemProfilePrivilege	4496	powershell.exe
Token: SeSystemtimePrivilege	4496	powershell.exe
Token: SeProfSingleProcessPrivilege	4496	powershell.exe
Token: SeIncBasePriorityPrivilege	4496	powershell.exe
Token: SeCreatePagefilePrivilege	4496	powershell.exe
Token: SeBackupPrivilege	4496	powershell.exe
Token: SeRestorePrivilege	4496	powershell.exe
Token: SeShutdownPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeSystemEnvironmentPrivilege	4496	powershell.exe
Token: SeRemoteShutdownPrivilege	4496	powershell.exe
Token: SeUndockPrivilege	4496	powershell.exe
Token: SeManageVolumePrivilege	4496	powershell.exe
Token: 33	4496	powershell.exe
Token: 34	4496	powershell.exe
Token: 35	4496	powershell.exe
Token: 36	4496	powershell.exe
Token: 33	3676	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3676	AUDIODG.EXE
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	SysSettingSvc.exe
3032	SysSettingSvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4080	2440	906.exe	81
PID 4080 wrote to memory of 4584	4080	906.exe	82
PID 4080 wrote to memory of 2244	4080	906.exe	84
PID 4080 wrote to memory of 4032	4080	906.exe	86
PID 4716 wrote to memory of 692	4716	InformerUpdate.exe	90
PID 4080 wrote to memory of 680	4080	906.exe	91
PID 680 wrote to memory of 1264	680	InformerUpdate.exe	92
PID 692 wrote to memory of 5024	692	InformerUpdate.exe	93
PID 5024 wrote to memory of 3032	5024	SysSettingSvc.exe	94
PID 3032 wrote to memory of 4496	3032	SysSettingSvc.exe	97
PID 1668 wrote to memory of 4388	1668	chrome.exe	100
PID 1668 wrote to memory of 4888	1668	chrome.exe	101
PID 1668 wrote to memory of 2088	1668	chrome.exe	102
PID 1668 wrote to memory of 2088	1668	chrome.exe	102
PID 1668 wrote to memory of 2604	1668	chrome.exe	103
PID 1668 wrote to memory of 2604	1668	chrome.exe	103
PID 1668 wrote to memory of 4124	1668	chrome.exe	105
PID 1668 wrote to memory of 3488	1668	chrome.exe	106
PID 1668 wrote to memory of 4124	1668	chrome.exe	105
PID 1668 wrote to memory of 3488	1668	chrome.exe	106
PID 1668 wrote to memory of 1648	1668	chrome.exe	108
PID 1668 wrote to memory of 1648	1668	chrome.exe	108
PID 1668 wrote to memory of 4040	1668	chrome.exe	109
PID 1668 wrote to memory of 4040	1668	chrome.exe	109
PID 1668 wrote to memory of 3324	1668	chrome.exe	110
PID 1668 wrote to memory of 4552	1668	chrome.exe	113
PID 1668 wrote to memory of 4552	1668	chrome.exe	113
PID 1668 wrote to memory of 472	1668	chrome.exe	114
PID 1668 wrote to memory of 472	1668	chrome.exe	114
PID 1668 wrote to memory of 3220	1668	chrome.exe	115
PID 1668 wrote to memory of 3220	1668	chrome.exe	115
PID 3032 wrote to memory of 4088	3032	SysSettingSvc.exe	121
PID 3032 wrote to memory of 4516	3032	SysSettingSvc.exe	122
PID 3032 wrote to memory of 696	3032	SysSettingSvc.exe	124
PID 3032 wrote to memory of 1448	3032	SysSettingSvc.exe	126
PID 3032 wrote to memory of 4220	3032	SysSettingSvc.exe	127
PID 3032 wrote to memory of 768	3032	SysSettingSvc.exe	130
PID 3032 wrote to memory of 2736	3032	SysSettingSvc.exe	132
PID 3032 wrote to memory of 2968	3032	SysSettingSvc.exe	133
PID 3032 wrote to memory of 2896	3032	SysSettingSvc.exe	135
PID 3032 wrote to memory of 1636	3032	SysSettingSvc.exe	137
PID 3032 wrote to memory of 1092	3032	SysSettingSvc.exe	138
PID 3032 wrote to memory of 4092	3032	SysSettingSvc.exe	139
PID 3032 wrote to memory of 4804	3032	SysSettingSvc.exe	140
PID 3032 wrote to memory of 2592	3032	SysSettingSvc.exe	141
PID 3032 wrote to memory of 880	3032	SysSettingSvc.exe	142
PID 3032 wrote to memory of 1068	3032	SysSettingSvc.exe	143
PID 3032 wrote to memory of 4852	3032	SysSettingSvc.exe	144
PID 3032 wrote to memory of 1888	3032	SysSettingSvc.exe	145
PID 3032 wrote to memory of 3488	3032	SysSettingSvc.exe	146
PID 3032 wrote to memory of 4124	3032	SysSettingSvc.exe	147
PID 3032 wrote to memory of 4648	3032	SysSettingSvc.exe	148
PID 3032 wrote to memory of 1228	3032	SysSettingSvc.exe	149
PID 3032 wrote to memory of 800	3032	SysSettingSvc.exe	150
PID 3032 wrote to memory of 2588	3032	SysSettingSvc.exe	151
PID 3032 wrote to memory of 5032	3032	SysSettingSvc.exe	152
PID 3032 wrote to memory of 2060	3032	SysSettingSvc.exe	153
PID 3032 wrote to memory of 656	3032	SysSettingSvc.exe	154
PID 3032 wrote to memory of 4428	3032	SysSettingSvc.exe	155
PID 3032 wrote to memory of 2460	3032	SysSettingSvc.exe	156
PID 3032 wrote to memory of 464	3032	SysSettingSvc.exe	157
PID 3032 wrote to memory of 2924	3032	SysSettingSvc.exe	158
PID 3032 wrote to memory of 3472	3032	SysSettingSvc.exe	159
PID 3032 wrote to memory of 2652	3032	SysSettingSvc.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\906.exe
"C:\Users\Admin\AppData\Local\Temp\906.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\906.exe
  "C:\Users\Admin\AppData\Local\Temp\906.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query
    3⤵
    PID:2244
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn TelemetrySync /tr \"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe\" /sc onlogon /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4032
- - C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe
    C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe
      C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1264

C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe
"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe
  "C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exe
    C:\Users\Admin\AppData\Roaming/Microsoft/Windows/ConfigService\SysSettingSvc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Get-CimInstance Win32_Processor | Select-Object -ExpandProperty Name"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:4220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2896
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:9172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1092
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:11548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4852
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:12952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2652
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:7900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4432
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:2396
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:12436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:2088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4720
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:15576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4680
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:12420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4176
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:17204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:5244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5300
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5328
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5368
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:5664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5424
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:3540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1268
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:17216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6188
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:15396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6444
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:17160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6692
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:7492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:7660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7972
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:7084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8176
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5972
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:16856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8224
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:8436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:8444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:9704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7176
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:8676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:9056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:9072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:9088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:10644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:10992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:11096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:11104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:12636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:12644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:12652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:12664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:12672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:12684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:14260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:14856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:11788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:15560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:15568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:15584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:15592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:15604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:15644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:16788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:9304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:7848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:6140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:4964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:5592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:13288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:16448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:16472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:1284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:2472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:9004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:15392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:17796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:17940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:17996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:18652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:18812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:18996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:19092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:19348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19504
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19512
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:19600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:19648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:19768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19984
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:19992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20176
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20224
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20432
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:20892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:20996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        Executes a command shell one-liner
        
        PID:21164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21512
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21984
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:21992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start cmd"
        5⤵
        
        PID:22064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb011ec728,0x7ffb011ec734,0x7ffb011ec740
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,1025711737597944073,13831412686288447441,524288 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,15100708001318359700,3343706939231237282,262144 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,4422678497757506601,17773939979894847624,524288 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,5461031641134232825,14817633565380203846,2097152 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,8464079415233804956,7242779967211297041,2097152 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,12965709694206790995,17938055093222757922,2097152 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:9
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,811671790923380851,17429922856515489542,2097152 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,3871376370735738770,15244957665835707509,524288 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5584,i,10331144049143311080,3060568920718430999,2097152 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6004,i,16447748317332074378,2695494486959833401,2097152 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6012,i,15935180932892761034,3569556974268543108,2097152 --field-trial-handle=2072,i,14659015787706049658,14085481897346336168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0cbde19ba4f6cc8b1557dd8d85fb568b83e5e08241d56ca6c20312e75023d32a
MD5 05eaed2676f93ffac604f6e7c5a83d3a
SHA1 4a8ccf60a067e720662e78a76aad45f6f85936d8
SHA512 ba149387e4beee3c6d773df995c1072f1040ebc4867f474162aed3434f401c4c94fcdd0de2f1998747d96cbd6274702c59d4f64067e6acc4b6dd7efc0a308c5d
TLSH
T1C2E02BAAC831EC374CFD4B5D60584B45E711139B2B80855F3B3D86098FB07761195D1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 2e1963f1b89eb98641eee01013aa51d7290388a68f8dd1d98aa0f146e65677d8
MD5 cfcf8668d58800d4394fcbb940d37e57
SHA1 c803c0b007256ab0453a424911d32eeaaad39172
SHA512 10852296354dbfc7073e8a89548296ee52f829ba248ebc8860be86562a4a4ac0177ac5f290bd4c048a63f4d699ef60685b8df6af8cd2d643a07413a79168f6aa
TLSH
T117C012AD9284D80CFB74D8F398A194E333D12F5040835AA741C751B9A8239BA4652123
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f953f22bfe45020af64987f98aa6da0ac31a38069215063730844afd8a9ba50a
MD5 64bb9a8cbdd27eb56323975f7da9bdb9
SHA1 fa87ec4711753977b3a587192b4fb2cb30ceba11
SHA512 76fc8f2f04a180f1c9dfe86e797197deb99209dc9e65b4cef9819a90658e923ef1d24a88927bcb217438fd615d59398fddc16a605f34745d320fe25b62951303
TLSH
T1D1715BF7C3E8853D891196E49B156F1FCE2D4A18421C3C66C8E8AE5B53E2872D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 0cbd23d609617a5badd137e106c9f76895794be5b11064c54979bcae32b52394
MD5 a6c30f2fd6bb37806766da725d13f04b
SHA1 b143294f86d1b5641e26c816d19c87f410af8b80
SHA512 d2c0ef6709227364f7e5286cb3ed1d3512c7f73f917bfc502f44629d1526bdf00d79d26df5e8b19cc7d63ec366469d08785c0a853eed24c41c6565e11d1c155b
TLSH
T1B8F059ABE2AD7427117A99AA6E05FC0925B6F434028168F4CF9BD16D90C21B32B22043
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 66dcede7fb6ee42766e6880683ca18e24df6bcf794756ad2ff6bc2b213f3515b
MD5 d39162187b311faa2b94a04b46a58121
SHA1 001f130ceec809d7709956ddbf6652851e767f81
SHA512 2df39f3efa12d0d99ad7300dda5369381c041907642884e23ba8931d41c82b93be04a50637cbe1e289101445a45ea502bfda0bbe1e8df6c3f21e17359dd44c7a
SSDEEP 192:6Rvjvi7v7RE6v7H+pAPRp2Es59WHsb+WNnD/4AY2bJ2bCa9Fa8JVyIsnAUgtaJ:6RvT8veWiUXqUwbU2l2GaDv8
TLSH
T13B52B62EB920653B9CDBD319FA667763D7F5202165943E84E6FC8A2C14E75CC321B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b2af804308ec5f7763996b2e8ba5b4884ce0343c1396718f1a59e456160e0802
MD5 a4ec93a287fae5da4a1cc1cbc5fe3197
SHA1 6aa4ca5daff06363377abfef51a47a98136d7ff4
SHA512 c20cc0d7cb1e1bee1ae6efd367d55961a36bd80a0294342f2d39159a7199e90c005a82c82557814a01dcdfe9923aed53d48c09f640bab360c40a414811db5e4f
SSDEEP 192:+Rvjvi7v7RAD6v7H+pAPRp2Es59WHsb+WNNngIBAY2eJ2bCa9Fa8yPyIsnAUgtaJ:+RvT8vuWiUXqUwx52q2GaDM8
TLSH
T17352C62EA920653B9CDBD329FA66B763D7F5202165D03E84E6FC892C14D75CC321B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8bdb544b7c3491455acb55a9cc61db89f55e7fc4bd3a0d88ff2c2523b4bac837
MD5 a3a6cf2f5eeb0bc4478438f2e918e2a4
SHA1 72750026265da38322377725a198e2b22357b4a9
SHA512 2fb6c5972e9c3a7f9b22977d18959f7bb008f28ab99fac2b669f5e3a528d8f2d5acbcccfeab73d8d513b429d7691d3d3abef0bf54c04e54cd1c6a88086207e07
TLSH
T1C4B01250C481A549C82206F4154634DC75549F109A0B170253E0692288261508214090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad841.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ad841.TMP
Size 96B
SHA256 0eefd761918d8b46ee245246b9e774fd8e23d0982b5ec0f0db4b4bd2afedcf39
MD5 e3370033410b62a85c9eb222ca37b8c4
SHA1 72527cd08059dde180add49c885348ecfb3d0b0f
SHA512 01126f2c125b6558e4eca67d47af1b55dc8a50564ecd70bc33badf2965c295a18163785628db0f9d0bed2d8531df6e9ed286e2b533f461c4d635ae7607917d0e
TLSH
T11CB0222CC0832302C00203B038C0CCCC30A0CF30C303020383E20A2ECC2A2200020030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 3e37d0e82f8c4dabf4719aa166a979c7aa2656f0f59a162c9b8d97421397487d
MD5 e401b3343c6241274048d5a042a56c1f
SHA1 ed8729b06ecdc6e3b122f7ef964b5530274fdffe
SHA512 2c6b7e996b296b8c71eb0c8eb12c169f5df812fa3ad01f2e53155dbb01ee6d46f0be04f3e77968e911c551e66642a345f0ed7d8189efd5041f05591afa75d39d
SSDEEP 6144:cWSfybk+WaOARvsx5gyLG6WDfxA3OnjrYQ9EU0/hEd:c5ybkIZEgHLDfxjjs+CK
TLSH
T19A3423A45D1F7F7B09ACEDA8300D3B54AFB46C9564C76CC7A7991F8905E89D8082AE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c13d271e1e39c5f061a49c31ad298b714d64c8d8aca750f374f1aa663825fac1
MD5 afc9df2e9a1dab6f78cec37dd74fcaf8
SHA1 6c0567f466d5099df21e604fd8fa106d7e70e84f
SHA512 4c8aef8cd77beb8b010c60e091eda2f9be62fc2b28655f0b0d001e34ca55a688a0708cfc2b436f1219e16584ca15135b1ca918fcbc0bc14c37083dfdd6492469
SSDEEP 3072:FzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:RWDfxA3OnjrYQ9EU0/hEV
TLSH
T10EC302A11C3ABD660DF8EE98B44D3A60BFF4AD9A91835DC361ED2F0C14FA5C81179970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 71fc5ca906be133fc391f0b3b66da91fe160d12ceaa650f76bfb07d53850550e
MD5 77f99c3438c26e9e34c90111294643ab
SHA1 9025fe6d7c13340a5247c96e93caf79dc3a73500
SHA512 0348f16f59538a9d41c860b3f682fff64698d57a3d19a1f11e7786941988cfe0ba4bb1d3df5de9f024922162aaf87516bb5118a3fe328c9583c2d7cb86cef979
SSDEEP 6144:gWSfybk+WaOARvsx5gyLG6WDfxA3OnjrYQ9EU0/hEd:g5ybkIZEgHLDfxjjs+CK
TLSH
T1F83423A45D1F7F7B09ACEDA8300D3B54AFB46C9564C76CC7A7991F8905F89D8082AE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

InformerUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\InformerUpdate.exe
Size 7.8MB
SHA256 4f849ee7c5b313499bf7284c7f44c7ab5f675f89fe9a50aefd25aacdc16c8e0f
MD5 614e731db65b54772bf7a98e5df669a6
SHA1 ca41c70574b5cc7d4d85c92e689f4d1008c0c1bc
SHA512 1bbb1abcbce900c60c5f12bbd8937cceff62f47a646ebbb46c4f729748552a66987f4d19c6be1f37c132deecce02a36bf56d9fc557ff83c613142425b4bc2fcb
SSDEEP 196608:X/CnXMCHGLLc54i1wN+6JjXx5nDasqWQ2dTNUGgSEhl4+iITmavMN:PCnXMCHWUj0jx5WsqWxTz09TJU
TLSH
T10086339867E009F5E5B7C03EDCA3D419EB71B8571BA4C69B93AC02D24E331E46D38B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\VCRUNTIME140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
TLSH
T14C936B4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6866A5F67BE05E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_bz2.pyd
Size 78KB
SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
MD5 b45e82a398713163216984f2feba88f6
SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8
SSDEEP 1536:owz7h8B7BjhJCZePYgIjFNf8AnZydTBIAMVyyw:owz18BrJCJgIHEAodTBIAMVy
TLSH
T12B738D52B36459F6F06BA27955704347E771BD0D0390C3BFB698426B2F13B916C7832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_ctypes.pyd
Size 117KB
SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
MD5 79f339753dc8954b8eb45fe70910937e
SHA1 3ad1bf9872dc779f32795988eb85c81fe47b3dd4
SHA512 21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753
SSDEEP 3072:SHcKPoHQUCFN1KQDCVPJGltBfrShpl7PFIABPI:ShP0ChjCxJGl3frSVzo
TLSH
T1A8C34A1B635400EAEA63407CC5B35E87DB71B859172183DF02A4C69E2F637E26E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_decimal.pyd
Size 241KB
SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
MD5 1cdd7239fc63b7c8a2e2bc0a08d9ea76
SHA1 85ef6f43ba1343b30a223c48442a8b4f5254d5b0
SHA512 ba4e19e122f83d477cc4be5e0dea184dafba2f438a587dd4f0ef038abd40cb9cdc1986ee69c34bac3af9cf2347bea137feea3b82e02cca1a7720d735cea7acda
SSDEEP 6144:xJADMQRl2npdNqRb8o+wmxYk29qWMa3pLW1ALH+4t4g3:IDMQ2Nqi02/U/+g3
TLSH
T134346C56A2490DA4DE73807899974B57F7B278940360D2CF43A4CAA73F537A323BE748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_hashlib.pyd
Size 57KB
SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
MD5 cfb9e0a73a6c9d6d35c2594e52e15234
SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2
SSDEEP 768:13RNYlTw3glkXa/bNnVXP5ZV17reFyPXS9aEyp6fZIAYIPVDG4ywh2:2TRiXa/bNFLVFPXS93fZIAYI3yz
TLSH
T1BC434B0A964000A1D97781BCD9A39F57FAB1F290631197EF9368C1CE2F537C316BAB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_lzma.pyd
Size 149KB
SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
MD5 5a77a1e70e054431236adb9e46f40582
SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635
SSDEEP 3072:3o6xxrSqs+vs0H0q8bnpbVDbX5AyYCznfo9mNomenNjc3KBIAD15:3o6DrScRLCV3twYOmUQKt
TLSH
T1ECE33A86A394F4E6F3228C78D6624F57D7F578190310929A02CC876D2B1FB75992F327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_socket.pyd
Size 72KB
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e
SSDEEP 1536:LmtpT7zWHzDfLrAe9/s+S+pBm/es6FIABwNyi:qTnzWzrAe9/sT+pBm/X6FIABwp
TLSH
T147735A11A79051FAE673817AC1635F23F7B0F480139593CF4664DA6E1F63782AE3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\base_library.zip
Size 858KB
SHA256 4d281afb40e4492d30b6bc178b15b68e6b996d4e32f6aa318c88e9be4378d137
MD5 6077aff5678402b0c97c2c2aae251527
SHA1 ed6bfe8712098768fc0f50e98ad0ab4eada368b9
SHA512 39c0f814585a6f06a870ab959abbd2583a3dc39a6bb5faa17629bd9fe18143351a8a41c00c18e04c99f8f272612b386ee268d1e19541adcd439a0d4849e71e54
SSDEEP 12288:GWybeQNnA4a2YhVw98S+lVghgUIy6uBtn7fJEoo4:GVCQNnLa2EVw9AVghxtn7fJEoJ
TLSH
T12C15398069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF076E00955A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\python3.DLL
Size 60KB
SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
MD5 a5471f05fd616b0f8e582211ea470a15
SHA1 cb5f8bf048dc4fc58f80bdfd2e04570dbef4730e
SHA512 e87d06778201615b129dcf4e8b4059399128276eb87102b5c3a64b6e92714f6b0d5bde5df4413cc1b66d33a77d7a3912eaa1035f73565dbfd62280d09d46abff
SSDEEP 768:ek8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqe:ekwewnvtjnsfwGFIAB0hy
TLSH
T1F9535C529B54FDA2DAF6A5FC38D1998D242B12CC972984ECB478D3D30E5A310A127F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
TLSH
T1A1267C22A35401A4DAB78477C5278747DBF2FC552F20D34A41A4BAD92F73BA316EE702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\select.pyd
Size 25KB
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012
SSDEEP 384:XPjk/7e12hwheCZHqh1BeshphFIAmGcDG4y8JAgwhp:fUC2hwh9Hq3rHhFIAmGcDG4yMwh
TLSH
T1DDC26E46EB505CC2E8238171B5E1CF06FE31B6514761C1EF7268C2692F57B8231BEB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\unicodedata.pyd
Size 1.1MB
SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
MD5 a40ff441b1b612b3b9f30f28fa3c680d
SHA1 42a309992bdbb68004e2b6b60b450e964276a8fc
SHA512 5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef
SSDEEP 12288:t0lBMmuZ63N6QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uUs:ilBuVZV0m81MMREtV6Vo4uYUs
TLSH
T162355909B9C24EE2E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A74EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\_ctypes.pyd
Size 122KB
SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
MD5 5377ab365c86bbcdd998580a79be28b4
SHA1 b0a6342df76c4da5b1e28a036025e274be322b35
SHA512 56f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26
SSDEEP 3072:IXw32spTVYgFoj6N2xE9sb7V/f/E4ZBq5syCtYPU95IMLPhr:IgGEOgFoj68ksRf/ERsX
TLSH
T174C36C1B339400A9EBA34178C4B36E07D7F1B41B076197CF12A4C6992F637A76E6E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
MD5 e8b9d74bfd1f6d1cc1d99b24f44da796
SHA1 a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452
SHA512 b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27
SSDEEP 192:zFOhcWqhWpvWEXCVWQ4iWwklRxwVIX01k9z3AROVaz4ILS:zFlWqhWpk6R9zeU0J2
TLSH
T15BA23BD38DF89143F9AAAD7046E8E9477C3C6BC20940A05A27D9F14D29D33D0EB24B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
MD5 cfe0c1dfde224ea5fed9bd5ff778a6e0
SHA1 5150e7edd1293e29d2e4d6bb68067374b8a07ce6
SHA512 b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000
SSDEEP 192:NWqhWEWEXCVWQ4cRWvBQrVXC4dlgX01k9z3AUj7W6SxtR:NWqhWPlZVXC4deR9zVj7QR
TLSH
T1F0A229C29ABC9143FEAB9E7012A8D9937C3D67D71A50916605A4F0881CD33C6EB34B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
MD5 33bbece432f8da57f17bf2e396ebaa58
SHA1 890df2dddfdf3eeccc698312d32407f3e2ec7eb1
SHA512 619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5
SSDEEP 192:T0WqhWnWEXCVWQ4mW5ocADB6ZX01k9z3AkprGvV:T0WqhW8VcTR9zJpr4V
TLSH
T13BA24C9256AC9043F99BADB062E8E9877C3867C35950E16701D8F5581D97381FB30B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
MD5 eb0978a9213e7f6fdd63b2967f02d999
SHA1 9833f4134f7ac4766991c918aece900acfbf969f
SHA512 6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63
SSDEEP 192:qzmxD3T4qLWqhW2WJWadJCsVWQ4mW/xNVAv+cQ0GX01k9z3ARoanSwT44:qzQVWqhWTCsiNbZR9zQoUSwTJ
TLSH
T1FAA22A928BBC8143F9AB9E7016A8E9573C3E67C65E4051950AD8F55C2D873C0FF20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
MD5 efad0ee0136532e8e8402770a64c71f9
SHA1 cda3774fe9781400792d8605869f4e6b08153e55
SHA512 69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852
SSDEEP 192:gaNYPvVX8rFTsCWqhWVWEXCVWQ4mWPJlBLrp0KBQfX01k9z3ALkBw:WPvVX8WqhWiyBRxB+R9z2kBw
TLSH
T113C21B83D9A4E25BFCCFDE7151A6D8436C3443D6041484C60BD8E75C3DE3386E7A8AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1
SSDEEP 192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
TLSH
T106A24B814AB88043F99BDE7052E8DA877C3977D61A5058560AE8F59C2D933C5FB30B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
SSDEEP 384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
TLSH
T1DE8218C1DABCE043FDC7ADB06298DA877D3CA7C31D10815A00A9F6A92CD73D59B14A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
MD5 e89cdcd4d95cda04e4abba8193a5b492
SHA1 5c0aee81f32d7f9ec9f0650239ee58880c9b0337
SHA512 55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e
SSDEEP 192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
TLSH
T1F4A22CD28B6C8047F9AB9D7042A8DA537C3E67C75D50949606E8F95C2C877C0EF20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
MD5 accc640d1b06fb8552fe02f823126ff5
SHA1 82ccc763d62660bfa8b8a09e566120d469f6ab67
SHA512 6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe
SSDEEP 192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
TLSH
T177A22BC99AA89103FD9F9E7052D5E9533C3977C61D50806605E8F2AC2C933C1EB39B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
MD5 c6024cc04201312f7688a021d25b056d
SHA1 48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd
SHA512 d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47
SSDEEP 192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
TLSH
T1E0A22BC186BC9142F9EBAE7052A8D9837C3867C7155094674BE4F59C28D73C1EB24B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
MD5 1f2a00e72bc8fa2bd887bdb651ed6de5
SHA1 04d92e41ce002251cc09c297cf2b38c4263709ea
SHA512 8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a
SSDEEP 192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
TLSH
T1B8A20BC2D6ACA143F9DA9DB052E4D9473C3967C79921D4B546D8F24C28E3391EB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
MD5 724223109e49cb01d61d63a8be926b8f
SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c
SSDEEP 384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
TLSH
T1E6A23B96D6A8E347F88DE971306AD8437C3D66C60811D59607E1FB1839E338AFB6172C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
MD5 3c38aac78b7ce7f94f4916372800e242
SHA1 c793186bcf8fdb55a1b74568102b4e073f6971d6
SHA512 c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588
SSDEEP 192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
TLSH
T17DA22A8A45BC9543F9DB9D7053A4DA837C39ABC719A0846707E8F5882C933C1DB24669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
MD5 321a3ca50e80795018d55a19bf799197
SHA1 df2d3c95fb4cbb298d255d342f204121d9d7ef7f
SHA512 3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a
SSDEEP 192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
TLSH
T1BCA23BD68AAC9182FD5F9E7043E4D5437C3AB7C62D10906912E9F9982C933D0EA35B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
MD5 0462e22f779295446cd0b63e61142ca5
SHA1 616a325cd5b0971821571b880907ce1b181126ae
SHA512 07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe
SSDEEP 192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
TLSH
T187A22AC299BC6102F9CABD7012E8F9673C3857E70D5090A615E4F65C28E7391FB64B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
MD5 c3632083b312c184cbdd96551fed5519
SHA1 a93e8e0af42a144009727d2decb337f963a9312e
SHA512 8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4
SSDEEP 192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
TLSH
T139A21BD685BC9283F8CE99306395E9132C7697C61C15847506E8F5AC3DEB3C2E63862D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
MD5 517eb9e2cb671ae49f99173d7f7ce43f
SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be
SSDEEP 192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
TLSH
T1ABA21BC29ABC5143FD9B9E705398E9533C3EB7C6691090AA05E8F19C2DD7381EB2172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\base_library.zip
Size 1.3MB
SHA256 ab049c6daeb458ebf8e536a8060570da3c82685a0e1618546b9e492d1aed98ec
MD5 cec896fe5c2ab658e7813b162d557781
SHA1 23fb974c9ac63a2cb5b9811c9bfd564b8ec8cc41
SHA512 b6c72468363aad32e36035fab6423428c260b96a3235d8146b6d98c5f9b65968fdc873629199f3ef31ee7b1162b761e6504fe34eb4d635d2222d18cbaaaffd5c
SSDEEP 12288:oclJGUq4Q1dsxQ//RO2/HFHcPndmRHtSYYTq+zYgEkA1qJujh/yquw1Lmn983G5:oclJGUis8g2/HxcPndmR0YPXfa983S
TLSH
T17055D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\python3.dll
Size 66KB
SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
MD5 5eace36402143b0205635818363d8e57
SHA1 ae7b03251a0bac083dec3b1802b5ca9c10132b4c
SHA512 7cb3619ea46fbaaf45abfa3d6f29e7a5522777980e0a9d2da021d6c68bcc380abe38e8004e1f31d817371fb3cdd5425d4bb115cb2dc0d40d59d111a2d98b21d4
SSDEEP 768:OV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/d:ODmF61JFn+/Ob5IML0l7SySxUx
TLSH
T112637052BB54F8A3DBFA65FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\python312.dll
Size 6.6MB
SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
MD5 166cc2f997cba5fc011820e6b46e8ea7
SHA1 d6179213afea084f02566ea190202c752286ca1f
SHA512 49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
SSDEEP 49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
TLSH
T170667D697268C0A9C96BA0B0CC13C28AE7B27C517F50530B70EBB75E2F737A2535A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47162\ucrtbase.dll
Size 992KB
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
SSDEEP 24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
TLSH
T12425AE68F66C0AA9D07BE17CC91B550FE9B23406477096DB03E64BB93E2B7D5163B320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pbfa5o5z.wjw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pbfa5o5z.wjw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3032-376-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-382-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-334-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-337-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-595-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-598-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-601-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-356-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-359-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-364-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-367-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-370-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-373-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-327-0x00007FF73DC20000-0x00007FF741866000-memory.dmp

Download

memory/3032-379-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-592-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-385-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-648-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-642-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-639-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-427-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-615-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-610-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-328-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-607-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-604-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/3032-473-0x0000025B0EF70000-0x0000025B13E22000-memory.dmp

Download

memory/4496-352-0x000001EFDE740000-0x000001EFDE764000-memory.dmp

Download

memory/4496-351-0x000001EFDE740000-0x000001EFDE76A000-memory.dmp

Download

memory/4496-350-0x000001EFDE7A0000-0x000001EFDE853000-memory.dmp

Download

memory/4584-72-0x000001E96E760000-0x000001E96E76A000-memory.dmp

Download

memory/4584-68-0x000001E96E670000-0x000001E96E68C000-memory.dmp

Download

memory/4584-77-0x000001E954A60000-0x000001E954A70000-memory.dmp

Download

memory/4584-52-0x000001E954A60000-0x000001E954A70000-memory.dmp

Download

memory/4584-51-0x000001E954A60000-0x000001E954A70000-memory.dmp

Download

memory/4584-60-0x000001E954A60000-0x000001E954A70000-memory.dmp

Download

memory/4584-61-0x00007FF4ED8F0000-0x00007FF4ED900000-memory.dmp

Download

memory/4584-59-0x000001E96E3D0000-0x000001E96E3F2000-memory.dmp

Download

memory/4584-69-0x000001E96E690000-0x000001E96E743000-memory.dmp

Download

memory/4584-70-0x000001E96E750000-0x000001E96E75A000-memory.dmp

Download

memory/4584-71-0x000001E96E780000-0x000001E96E79C000-memory.dmp

Download

memory/4584-73-0x000001E96E7C0000-0x000001E96E7DA000-memory.dmp

Download

memory/4584-74-0x000001E96E770000-0x000001E96E778000-memory.dmp

Download

memory/4584-75-0x000001E96E7A0000-0x000001E96E7A6000-memory.dmp

Download

memory/4584-76-0x000001E96E7B0000-0x000001E96E7BA000-memory.dmp

Download

memory/5024-326-0x00007FF73DC20000-0x00007FF741866000-memory.dmp

Download