3ed12a1e384392b38254dfcf9a2f7303a2621f53394af19a948a0485ddc46481

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lebron/lebron_face.bat
Size 293B
Sample260825-cdrd3sff74
SHA256 3ed12a1e384392b38254dfcf9a2f7303a2621f53394af19a948a0485ddc46481
MD5 67916ac9bfe76160c49777eecfad3cef
SHA1 99ca3d498fee53575860d5a73f2cc14d1b2e43f9
SHA512 33b8e21e9026fc61cd58d8edf94e3f79ea374020b7d48f666aaac85fc87e2d4b286dc46fa17a6f1993a2a2e5694629959bc5e4439a0a31ada7d196d1372ce672
TLSH
T131E0899A03D7BCAE16D678800FEA09559B09706E492E745FFF002EA887DD5DC11B481D
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6628	cmd.exe
7072	cmd.exe
7088	cmd.exe
7304	cmd.exe
12556	cmd.exe
9584	cmd.exe
4992	cmd.exe
4340	cmd.exe
4372	cmd.exe
5448	cmd.exe
6212	cmd.exe
6916	cmd.exe
7540	cmd.exe
9140	cmd.exe
8188	cmd.exe
10272	cmd.exe
10252	cmd.exe
13056	cmd.exe
1936	cmd.exe
2068	cmd.exe
5620	cmd.exe
6080	cmd.exe
7620	cmd.exe
7764	cmd.exe
7912	cmd.exe
10580	cmd.exe
1288	cmd.exe
8692	cmd.exe
10332	cmd.exe
10796	cmd.exe
11940	cmd.exe
11344	cmd.exe
1676	cmd.exe
5668	cmd.exe
7152	cmd.exe
11872	cmd.exe
1516	cmd.exe
3864	cmd.exe
12496	cmd.exe
4752	cmd.exe
6148	cmd.exe
8544	cmd.exe
9508	cmd.exe
6856	cmd.exe
2632	cmd.exe
5092	cmd.exe
10452	cmd.exe
10876	cmd.exe
12312	cmd.exe
2284	cmd.exe
5560	cmd.exe
11556	cmd.exe
1112	cmd.exe
1432	cmd.exe
10068	cmd.exe
3776	cmd.exe
784	cmd.exe
7348	cmd.exe
9016	cmd.exe
12632	cmd.exe
10112	cmd.exe
5692	cmd.exe
3312	cmd.exe
1832	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe

Delays execution with timeout.exe 40 IoCs

defense_evasion

pid	Process
7036	timeout.exe
3360	timeout.exe
9908	timeout.exe
3556	timeout.exe
11116	timeout.exe
12408	timeout.exe
13076	timeout.exe
5680	timeout.exe
6292	timeout.exe
8428	timeout.exe
10836	timeout.exe
11344	timeout.exe
12748	timeout.exe
536	timeout.exe
7876	timeout.exe
7244	timeout.exe
9064	timeout.exe
8844	timeout.exe
9696	timeout.exe
10216	timeout.exe
10496	timeout.exe
4748	timeout.exe
7040	timeout.exe
7480	timeout.exe
9908	timeout.exe
5744	timeout.exe
11672	timeout.exe
12076	timeout.exe
5252	timeout.exe
2864	timeout.exe
1776	timeout.exe
6092	timeout.exe
8732	timeout.exe
1764	timeout.exe
3400	timeout.exe
3700	timeout.exe
5296	timeout.exe
5752	timeout.exe
6668	timeout.exe
9380	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5180	dwm.exe
Token: SeChangeNotifyPrivilege	5180	dwm.exe
Token: 33	5180	dwm.exe
Token: SeIncBasePriorityPrivilege	5180	dwm.exe
Token: SeShutdownPrivilege	5180	dwm.exe
Token: SeCreatePagefilePrivilege	5180	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 1352	2808	cmd.exe	86
PID 2808 wrote to memory of 536	2808	cmd.exe	88
PID 1352 wrote to memory of 1128	1352	cmd.exe	89
PID 1352 wrote to memory of 2172	1352	cmd.exe	91
PID 1128 wrote to memory of 444	1128	cmd.exe	92
PID 1128 wrote to memory of 4452	1128	cmd.exe	94
PID 444 wrote to memory of 784	444	cmd.exe	95
PID 2808 wrote to memory of 3000	2808	cmd.exe	97
PID 444 wrote to memory of 1468	444	cmd.exe	98
PID 784 wrote to memory of 1288	784	cmd.exe	99
PID 784 wrote to memory of 3400	784	cmd.exe	101
PID 1288 wrote to memory of 4752	1288	cmd.exe	102
PID 1288 wrote to memory of 1956	1288	cmd.exe	104
PID 4752 wrote to memory of 2284	4752	cmd.exe	105
PID 4752 wrote to memory of 636	4752	cmd.exe	107
PID 2284 wrote to memory of 2408	2284	cmd.exe	108
PID 2284 wrote to memory of 3764	2284	cmd.exe	110
PID 2408 wrote to memory of 3312	2408	cmd.exe	111
PID 784 wrote to memory of 2904	784	cmd.exe	113
PID 2408 wrote to memory of 3700	2408	cmd.exe	114
PID 3312 wrote to memory of 1748	3312	cmd.exe	115
PID 3312 wrote to memory of 4804	3312	cmd.exe	117
PID 1748 wrote to memory of 3468	1748	cmd.exe	118
PID 3468 wrote to memory of 1432	3468	cmd.exe	121
PID 1748 wrote to memory of 4608	1748	cmd.exe	123
PID 3468 wrote to memory of 920	3468	cmd.exe	124
PID 1432 wrote to memory of 2632	1432	cmd.exe	125
PID 1432 wrote to memory of 2088	1432	cmd.exe	127
PID 2632 wrote to memory of 656	2632	cmd.exe	128
PID 2632 wrote to memory of 2864	2632	cmd.exe	129
PID 656 wrote to memory of 4992	656	cmd.exe	131
PID 2408 wrote to memory of 3984	2408	cmd.exe	133
PID 656 wrote to memory of 3012	656	cmd.exe	134
PID 4992 wrote to memory of 1936	4992	cmd.exe	135
PID 1936 wrote to memory of 1676	1936	cmd.exe	137
PID 4992 wrote to memory of 3868	4992	cmd.exe	139
PID 1936 wrote to memory of 1552	1936	cmd.exe	140
PID 1676 wrote to memory of 2452	1676	cmd.exe	141
PID 2452 wrote to memory of 2532	2452	cmd.exe	143
PID 2452 wrote to memory of 1776	2452	cmd.exe	144
PID 1676 wrote to memory of 3504	1676	cmd.exe	146
PID 2532 wrote to memory of 1832	2532	cmd.exe	147
PID 2632 wrote to memory of 2108	2632	cmd.exe	149
PID 2532 wrote to memory of 3952	2532	cmd.exe	150
PID 1832 wrote to memory of 2068	1832	cmd.exe	151
PID 2068 wrote to memory of 3164	2068	cmd.exe	153
PID 1832 wrote to memory of 3316	1832	cmd.exe	155
PID 3164 wrote to memory of 4916	3164	cmd.exe	156
PID 2068 wrote to memory of 4184	2068	cmd.exe	157
PID 3164 wrote to memory of 816	3164	cmd.exe	158
PID 2452 wrote to memory of 4200	2452	cmd.exe	161
PID 4916 wrote to memory of 3380	4916	cmd.exe	162
PID 4916 wrote to memory of 4748	4916	cmd.exe	164
PID 3380 wrote to memory of 4340	3380	cmd.exe	165
PID 3380 wrote to memory of 4144	3380	cmd.exe	167
PID 4340 wrote to memory of 4372	4340	cmd.exe	168
PID 4340 wrote to memory of 4304	4340	cmd.exe	170
PID 4372 wrote to memory of 4940	4372	cmd.exe	171
PID 4940 wrote to memory of 3788	4940	cmd.exe	173
PID 4940 wrote to memory of 3556	4940	cmd.exe	174
PID 4372 wrote to memory of 3700	4372	cmd.exe	176
PID 3788 wrote to memory of 1988	3788	cmd.exe	177
PID 4916 wrote to memory of 3436	4916	cmd.exe	178
PID 1988 wrote to memory of 5104	1988	cmd.exe	180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lebron\lebron_face.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lebron_face.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K lebron_face.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K lebron_face.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:784
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        17⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        18⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        21⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        22⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        26⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        27⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        31⤵
        
        PID:5104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        32⤵
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        33⤵
        
        PID:5184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        34⤵
        
        PID:5256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        35⤵
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        36⤵
        Executes a command shell one-liner
        
        PID:5448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        37⤵
        
        PID:5500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        38⤵
        Executes a command shell one-liner
        
        PID:5560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        39⤵
        Executes a command shell one-liner
        
        PID:5620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        40⤵
        Executes a command shell one-liner
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        41⤵
        
        PID:5768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        42⤵
        
        PID:5880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        43⤵
        
        PID:6000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        44⤵
        Executes a command shell one-liner
        
        PID:6080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        45⤵
        
        PID:4688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        46⤵
        Executes a command shell one-liner
        
        PID:5692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        47⤵
        Executes a command shell one-liner
        
        PID:6148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        48⤵
        Executes a command shell one-liner
        
        PID:6212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        49⤵
        
        PID:6260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        50⤵
        
        PID:6340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        51⤵
        
        PID:6444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        52⤵
        
        PID:6496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        53⤵
        
        PID:6564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        54⤵
        Executes a command shell one-liner
        
        PID:6628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        55⤵
        
        PID:6716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        56⤵
        
        PID:6760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        57⤵
        Executes a command shell one-liner
        
        PID:6856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        58⤵
        Executes a command shell one-liner
        
        PID:6916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        59⤵
        
        PID:6996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        60⤵
        Executes a command shell one-liner
        
        PID:7072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        61⤵
        Executes a command shell one-liner
        
        PID:7152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        62⤵
        Executes a command shell one-liner
        
        PID:5092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        63⤵
        Executes a command shell one-liner
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        64⤵
        
        PID:7224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        65⤵
        Executes a command shell one-liner
        
        PID:7304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        66⤵
        Executes a command shell one-liner
        
        PID:7348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        67⤵
        
        PID:7432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        68⤵
        
        PID:7496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        69⤵
        Executes a command shell one-liner
        
        PID:7540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        70⤵
        Executes a command shell one-liner
        
        PID:7620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        71⤵
        Executes a command shell one-liner
        
        PID:7764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        72⤵
        
        PID:7844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        73⤵
        Executes a command shell one-liner
        
        PID:7912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        74⤵
        
        PID:8012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        75⤵
        
        PID:8084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        76⤵
        
        PID:8160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        77⤵
        
        PID:7368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        78⤵
        
        PID:3564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        79⤵
        
        PID:7868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        80⤵
        Executes a command shell one-liner
        
        PID:8188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        81⤵
        
        PID:8196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        82⤵
        
        PID:8272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        83⤵
        
        PID:8332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        84⤵
        
        PID:8396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        85⤵
        
        PID:8468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        86⤵
        Executes a command shell one-liner
        
        PID:8544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        87⤵
        
        PID:8620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        88⤵
        Executes a command shell one-liner
        
        PID:8692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        89⤵
        
        PID:8772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        90⤵
        
        PID:8832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        91⤵
        
        PID:8892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        92⤵
        
        PID:8952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        93⤵
        Executes a command shell one-liner
        
        PID:9016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        94⤵
        
        PID:9088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        95⤵
        Executes a command shell one-liner
        
        PID:9140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        96⤵
        
        PID:3804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        97⤵
        
        PID:8672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        98⤵
        
        PID:9192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        99⤵
        
        PID:9236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        100⤵
        
        PID:9296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        101⤵
        
        PID:9368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        102⤵
        
        PID:9448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        103⤵
        Executes a command shell one-liner
        
        PID:9508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        104⤵
        Executes a command shell one-liner
        
        PID:9584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        105⤵
        
        PID:9648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        106⤵
        
        PID:9712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        107⤵
        
        PID:9756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        108⤵
        
        PID:9832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        109⤵
        
        PID:9896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        110⤵
        
        PID:10008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        111⤵
        Executes a command shell one-liner
        
        PID:10068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        112⤵
        Executes a command shell one-liner
        
        PID:10112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        113⤵
        
        PID:10184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        114⤵
        
        PID:9392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        115⤵
        
        PID:9700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        116⤵
        
        PID:9912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        117⤵
        Executes a command shell one-liner
        
        PID:10272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        118⤵
        Executes a command shell one-liner
        
        PID:10332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        119⤵
        
        PID:10392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        120⤵
        Executes a command shell one-liner
        
        PID:10452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        121⤵
        
        PID:10536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        122⤵
        Executes a command shell one-liner
        
        PID:10580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        123⤵
        
        PID:10640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        124⤵
        
        PID:10716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        125⤵
        Executes a command shell one-liner
        
        PID:10796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        126⤵
        Executes a command shell one-liner
        
        PID:10876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        127⤵
        
        PID:10940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        128⤵
        
        PID:10984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        129⤵
        
        PID:11044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        130⤵
        
        PID:11164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        131⤵
        
        PID:11224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        132⤵
        Executes a command shell one-liner
        
        PID:10252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        133⤵
        
        PID:10836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        134⤵
        
        PID:11236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        135⤵
        
        PID:5428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        136⤵
        
        PID:11324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        137⤵
        
        PID:11424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        138⤵
        
        PID:11480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        139⤵
        Executes a command shell one-liner
        
        PID:11556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        140⤵
        
        PID:11632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        141⤵
        
        PID:11712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        142⤵
        
        PID:11780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        143⤵
        Executes a command shell one-liner
        
        PID:11872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        144⤵
        Executes a command shell one-liner
        
        PID:11940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        145⤵
        
        PID:12028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        146⤵
        
        PID:12108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        147⤵
        
        PID:12192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        148⤵
        
        PID:12248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        149⤵
        Executes a command shell one-liner
        
        PID:1516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        150⤵
        Executes a command shell one-liner
        
        PID:11344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        151⤵
        
        PID:4524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        152⤵
        
        PID:12120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        153⤵
        Executes a command shell one-liner
        
        PID:3864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        154⤵
        Executes a command shell one-liner
        
        PID:1112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        155⤵
        Executes a command shell one-liner
        
        PID:12312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        156⤵
        
        PID:12384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        157⤵
        Executes a command shell one-liner
        
        PID:12496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        158⤵
        Executes a command shell one-liner
        
        PID:12556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        159⤵
        Executes a command shell one-liner
        
        PID:12632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        160⤵
        
        PID:12728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        161⤵
        
        PID:12824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        162⤵
        
        PID:12892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        163⤵
        
        PID:12960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        164⤵
        Executes a command shell one-liner
        
        PID:13056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        165⤵
        
        PID:13144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        166⤵
        
        PID:13220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        167⤵
        
        PID:13280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        168⤵
        Executes a command shell one-liner
        
        PID:3776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K lebron_face.bat
        169⤵
        
        PID:5604
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        168⤵
        Delays execution with timeout.exe
        
        PID:5252
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        167⤵
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        166⤵
        
        PID:12428
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        165⤵
        
        PID:4700
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        164⤵
        Delays execution with timeout.exe
        
        PID:13076
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        164⤵
        
        PID:5556
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        163⤵
        
        PID:13264
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        162⤵
        
        PID:13188
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        161⤵
        
        PID:13128
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        160⤵
        Delays execution with timeout.exe
        
        PID:12748
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        160⤵
        
        PID:3612
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        159⤵
        
        PID:12928
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        158⤵
        
        PID:12860
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        157⤵
        
        PID:12808
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        156⤵
        Delays execution with timeout.exe
        
        PID:12408
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        156⤵
        
        PID:13000
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        155⤵
        
        PID:12692
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        154⤵
        
        PID:12616
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        153⤵
        
        PID:12548
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        152⤵
        Delays execution with timeout.exe
        
        PID:1764
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        152⤵
        
        PID:12704
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        151⤵
        
        PID:12476
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        150⤵
        
        PID:12368
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        149⤵
        
        PID:1744
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        148⤵
        Delays execution with timeout.exe
        
        PID:5752
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        148⤵
        
        PID:12464
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        147⤵
        
        PID:1884
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        146⤵
        
        PID:11348
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        145⤵
        Delays execution with timeout.exe
        
        PID:12076
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        145⤵
        
        PID:936
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        144⤵
        
        PID:12136
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        143⤵
        
        PID:12176
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        142⤵
        
        PID:11992
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        141⤵
        
        PID:11976
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        140⤵
        Delays execution with timeout.exe
        
        PID:11672
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        140⤵
        
        PID:3188
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        139⤵
        
        PID:11856
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        138⤵
        
        PID:11824
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        137⤵
        
        PID:11748
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        136⤵
        Delays execution with timeout.exe
        
        PID:11344
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        136⤵
        
        PID:11900
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        135⤵
        
        PID:11596
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        134⤵
        
        PID:11528
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        133⤵
        Delays execution with timeout.exe
        
        PID:5744
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        133⤵
        
        PID:11680
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        132⤵
        
        PID:11268
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        131⤵
        
        PID:10840
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        130⤵
        
        PID:5360
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        129⤵
        Delays execution with timeout.exe
        
        PID:11116
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        129⤵
        
        PID:11408
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        128⤵
        
        PID:10508
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        127⤵
        
        PID:10244
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        126⤵
        
        PID:11192
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        125⤵
        Delays execution with timeout.exe
        
        PID:10836
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        125⤵
        
        PID:11052
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        124⤵
        
        PID:11080
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        123⤵
        
        PID:10744
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        122⤵
        
        PID:10860
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        121⤵
        
        PID:10908
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        120⤵
        Delays execution with timeout.exe
        
        PID:10496
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        120⤵
        
        PID:11124
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        119⤵
        
        PID:10684
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        118⤵
        
        PID:10648
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        117⤵
        
        PID:10616
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        116⤵
        Delays execution with timeout.exe
        
        PID:9908
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        116⤵
        
        PID:10780
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        115⤵
        
        PID:10436
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        114⤵
        
        PID:10376
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        113⤵
        Delays execution with timeout.exe
        
        PID:10216
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        113⤵
        
        PID:10520
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        112⤵
        
        PID:10196
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        111⤵
        
        PID:9684
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        110⤵
        
        PID:10168
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        109⤵
        Delays execution with timeout.exe
        
        PID:9908
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        109⤵
        
        PID:10264
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        108⤵
        
        PID:9984
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        107⤵
        
        PID:9960
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        106⤵
        
        PID:9976
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        105⤵
        Delays execution with timeout.exe
        
        PID:9696
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        105⤵
        
        PID:10024
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        104⤵
        
        PID:9868
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        103⤵
        
        PID:9800
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        102⤵
        
        PID:9632
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        101⤵
        Delays execution with timeout.exe
        
        PID:9380
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        101⤵
        
        PID:9784
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        100⤵
        
        PID:9544
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        99⤵
        
        PID:9476
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        98⤵
        
        PID:9412
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        97⤵
        Delays execution with timeout.exe
        
        PID:8844
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        97⤵
        
        PID:9564
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        96⤵
        
        PID:9280
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        95⤵
        
        PID:9068
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        94⤵
        
        PID:9152
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        93⤵
        Delays execution with timeout.exe
        
        PID:9064
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        93⤵
        
        PID:9332
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        92⤵
        
        PID:9160
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        91⤵
        
        PID:9080
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        90⤵
        
        PID:8960
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        89⤵
        
        PID:8908
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        88⤵
        Delays execution with timeout.exe
        
        PID:8732
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        88⤵
        
        PID:7876
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        87⤵
        
        PID:8808
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        86⤵
        
        PID:8740
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        85⤵
        
        PID:8676
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        84⤵
        Delays execution with timeout.exe
        
        PID:8428
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        84⤵
        
        PID:8860
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        83⤵
        
        PID:8560
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        82⤵
        
        PID:8528
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        81⤵
        
        PID:8460
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        80⤵
        
        PID:8380
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        79⤵
        Delays execution with timeout.exe
        
        PID:3360
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        79⤵
        
        PID:8596
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        78⤵
        
        PID:8252
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        77⤵
        
        PID:8240
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        76⤵
        Delays execution with timeout.exe
        
        PID:7244
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        76⤵
        
        PID:8308
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        75⤵
        
        PID:7880
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        74⤵
        
        PID:8076
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        73⤵
        
        PID:8136
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        72⤵
        Delays execution with timeout.exe
        
        PID:7876
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        72⤵
        
        PID:1880
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        71⤵
        
        PID:7948
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        70⤵
        
        PID:7996
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        69⤵
        
        PID:7964
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        68⤵
        
        PID:7572
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        67⤵
        Delays execution with timeout.exe
        
        PID:7480
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        67⤵
        
        PID:8040
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        66⤵
        
        PID:7412
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        65⤵
        
        PID:7356
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        64⤵
        
        PID:7264
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        63⤵
        Delays execution with timeout.exe
        
        PID:7040
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        63⤵
        
        PID:7548
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        62⤵
        
        PID:6668
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        61⤵
        
        PID:6928
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        60⤵
        
        PID:6012
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        59⤵
        Delays execution with timeout.exe
        
        PID:7036
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        59⤵
        
        PID:7200
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        58⤵
        
        PID:7112
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        57⤵
        
        PID:7060
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        56⤵
        
        PID:6952
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        55⤵
        
        PID:6976
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        54⤵
        Delays execution with timeout.exe
        
        PID:6668
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        54⤵
        
        PID:7136
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        53⤵
        
        PID:6824
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        52⤵
        
        PID:6620
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        51⤵
        
        PID:6688
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        50⤵
        
        PID:6544
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        49⤵
        Delays execution with timeout.exe
        
        PID:6292
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        49⤵
        
        PID:6892
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        48⤵
        
        PID:6368
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        47⤵
        
        PID:6280
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        46⤵
        
        PID:6184
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        45⤵
        
        PID:6088
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        44⤵
        Delays execution with timeout.exe
        
        PID:6092
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        44⤵
        
        PID:6392
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        43⤵
        
        PID:5384
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        42⤵
        
        PID:5140
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        41⤵
        
        PID:6052
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        40⤵
        Delays execution with timeout.exe
        
        PID:5680
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        40⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        39⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        38⤵
        
        PID:5724
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        37⤵
        
        PID:5596
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        36⤵
        
        PID:5544
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        35⤵
        
        PID:5440
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        34⤵
        Delays execution with timeout.exe
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        34⤵
        
        PID:5976
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        33⤵
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        32⤵
        
        PID:5236
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        31⤵
        
        PID:5160
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        30⤵
        
        PID:2816
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        29⤵
        Delays execution with timeout.exe
        
        PID:3556
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        29⤵
        
        PID:5288
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        28⤵
        
        PID:3700
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        27⤵
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        26⤵
        
        PID:4144
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        25⤵
        Delays execution with timeout.exe
        
        PID:4748
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        25⤵
        
        PID:3436
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        24⤵
        
        PID:816
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        23⤵
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        22⤵
        
        PID:3316
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        21⤵
        
        PID:3952
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        20⤵
        Delays execution with timeout.exe
        
        PID:1776
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        20⤵
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        19⤵
        
        PID:3504
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        18⤵
        
        PID:1552
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        17⤵
        
        PID:3868
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        16⤵
        
        PID:3012
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        15⤵
        Delays execution with timeout.exe
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        15⤵
        
        PID:2108
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        14⤵
        
        PID:2088
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        13⤵
        
        PID:920
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        12⤵
        
        PID:4608
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        11⤵
        
        PID:4804
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        10⤵
        Delays execution with timeout.exe
        
        PID:3700
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        10⤵
        
        PID:3984
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        9⤵
        
        PID:3764
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        8⤵
        
        PID:636
        
        C:\Windows\system32\cmd.exe
        
        cmd /k
        7⤵
        
        PID:1956
      - C:\Windows\system32\timeout.exe
        
        TIMEOUT 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3400
      - C:\Windows\system32\cmd.exe
        
        cmd /k
        6⤵
        
        PID:2904
    - - C:\Windows\system32\cmd.exe
        
        cmd /k
        5⤵
        
        PID:1468
  - - C:\Windows\system32\cmd.exe
      cmd /k
      4⤵
      PID:4452
- - C:\Windows\system32\cmd.exe
    cmd /k
    3⤵
    PID:2172
- C:\Windows\system32\timeout.exe
  TIMEOUT 1
  2⤵
  - Delays execution with timeout.exe
  PID:536
- C:\Windows\system32\cmd.exe
  cmd /k
  2⤵
  PID:3000

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

null

Path C:\Users\Admin\AppData\Local\Temp\lebron\null
Size 56B
SHA256 a31c73ccbf32777dca9ff9ec868eff833e16d2418e14d7e4977a49c435446081
MD5 a73fee14fd30d4476f73241f1a5abfd1
SHA1 cc516b4047c42506e5cc53013ad5b084f33506d2
SHA512 5db81f7d4ba2c50f87af7604e0be76a8957e54a32e35431dcab63e37c2a4e3ffe51a401ad80c431d8db43ae4b360b8172ba2a1832f79cad2e68a22d10bd6b79e
TLSH
T1399002674C4C45AC1BA4445344D1A2202C6E5508A1060602705714C923D4051551F5C4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads