40cb13e01b5392a41518296627274ed37d8fdb4763cbf741ba9f94dcb4b74649

Analysis

max time kernel
25s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4sw339d.exe
Size 8.5MB
Sample261007-wphqvscx3w
SHA256 40cb13e01b5392a41518296627274ed37d8fdb4763cbf741ba9f94dcb4b74649
MD5 0172dc1f2865fda297e7e9b77c22525c
SHA1 9bc744a87ffda6d14e3c5588b729dab957045b08
SHA512 df0f842117934c231c72a4f0532b2c576d4be82707ebfe13a567b63e80bb001b0afd613dc24a40134c48f9f8d8bd9d92137e44a6ab96e65cdbd52beea5293e10
SSDEEP 196608:O+jaZMPXEpXnH2ph1igtlxSiLCw10+u41ZPcUcQtytvonYcPT11pZ:z+ZMPXEAphJtD510MjjytvUY8
TLSH
T15D963358B7A011FAF8B3813D49A68852E6F232130B96D3DB13B051262F736F05D7CBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2532	4sw339d.exe
2532	4sw339d.exe
2532	4sw339d.exe
2532	4sw339d.exe
2532	4sw339d.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4736	cmd.exe
4896	cmd.exe
5104	cmd.exe
8684	cmd.exe
4188	cmd.exe
1204	cmd.exe
7360	cmd.exe
7576	cmd.exe
8528	cmd.exe
8708	cmd.exe
9868	cmd.exe
4008	cmd.exe
6636	cmd.exe
8820	cmd.exe
9068	cmd.exe
10392	cmd.exe
7216	cmd.exe
8580	cmd.exe
8956	cmd.exe
2728	cmd.exe
1228	cmd.exe
7036	cmd.exe
7384	cmd.exe
8392	cmd.exe
8336	cmd.exe
10264	cmd.exe
10452	cmd.exe
5544	cmd.exe
6284	cmd.exe
7296	cmd.exe
8120	cmd.exe
3792	cmd.exe
1776	cmd.exe
5136	cmd.exe
6728	cmd.exe
6580	cmd.exe
8608	cmd.exe
4648	cmd.exe
6912	cmd.exe
6672	cmd.exe
7756	cmd.exe
7724	cmd.exe
9744	cmd.exe
11292	cmd.exe
3540	cmd.exe
5668	cmd.exe
232	cmd.exe
6660	cmd.exe
6604	cmd.exe
8904	cmd.exe
9532	cmd.exe
10280	cmd.exe
1660	cmd.exe
2468	cmd.exe
6452	cmd.exe
8020	cmd.exe
9320	cmd.exe
4408	cmd.exe
3288	cmd.exe
1020	cmd.exe
6548	cmd.exe
7524	cmd.exe
8200	cmd.exe
9240	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	4sw339d.exe
2532	4sw339d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2532	3440	4sw339d.exe	82
PID 2532 wrote to memory of 3496	2532	4sw339d.exe	83
PID 3496 wrote to memory of 2160	3496	cmd.exe	86
PID 2532 wrote to memory of 5544	2532	4sw339d.exe	88
PID 5544 wrote to memory of 4100	5544	cmd.exe	90
PID 2532 wrote to memory of 5600	2532	4sw339d.exe	92
PID 5600 wrote to memory of 5572	5600	cmd.exe	94
PID 2532 wrote to memory of 4736	2532	4sw339d.exe	96
PID 4736 wrote to memory of 4164	4736	cmd.exe	98
PID 2532 wrote to memory of 432	2532	4sw339d.exe	100
PID 432 wrote to memory of 1060	432	cmd.exe	102
PID 2532 wrote to memory of 1816	2532	4sw339d.exe	104
PID 1816 wrote to memory of 5824	1816	cmd.exe	106
PID 2532 wrote to memory of 2200	2532	4sw339d.exe	108
PID 2200 wrote to memory of 2836	2200	cmd.exe	110
PID 2532 wrote to memory of 5332	2532	4sw339d.exe	112
PID 5332 wrote to memory of 2304	5332	cmd.exe	114
PID 2532 wrote to memory of 5660	2532	4sw339d.exe	116
PID 5660 wrote to memory of 4512	5660	cmd.exe	118
PID 2532 wrote to memory of 4408	2532	4sw339d.exe	120
PID 4408 wrote to memory of 3888	4408	cmd.exe	122
PID 2532 wrote to memory of 2576	2532	4sw339d.exe	124
PID 2576 wrote to memory of 1480	2576	cmd.exe	126
PID 2532 wrote to memory of 5708	2532	4sw339d.exe	128
PID 5708 wrote to memory of 5304	5708	cmd.exe	130
PID 2532 wrote to memory of 4200	2532	4sw339d.exe	132
PID 4200 wrote to memory of 1016	4200	cmd.exe	134
PID 2532 wrote to memory of 5604	2532	4sw339d.exe	136
PID 5604 wrote to memory of 5220	5604	cmd.exe	138
PID 2532 wrote to memory of 564	2532	4sw339d.exe	140
PID 564 wrote to memory of 5844	564	cmd.exe	142
PID 2532 wrote to memory of 3392	2532	4sw339d.exe	144
PID 3392 wrote to memory of 5984	3392	cmd.exe	146
PID 2532 wrote to memory of 2728	2532	4sw339d.exe	148
PID 2728 wrote to memory of 1328	2728	cmd.exe	150
PID 2532 wrote to memory of 3028	2532	4sw339d.exe	152
PID 3028 wrote to memory of 5308	3028	cmd.exe	154
PID 2532 wrote to memory of 4896	2532	4sw339d.exe	156
PID 4896 wrote to memory of 2968	4896	cmd.exe	158
PID 2532 wrote to memory of 4084	2532	4sw339d.exe	160
PID 4084 wrote to memory of 3964	4084	cmd.exe	162
PID 2532 wrote to memory of 5196	2532	4sw339d.exe	164
PID 5196 wrote to memory of 1856	5196	cmd.exe	166
PID 2532 wrote to memory of 4776	2532	4sw339d.exe	168
PID 4776 wrote to memory of 2584	4776	cmd.exe	170
PID 2532 wrote to memory of 5436	2532	4sw339d.exe	172
PID 5436 wrote to memory of 3892	5436	cmd.exe	174
PID 2532 wrote to memory of 1828	2532	4sw339d.exe	176
PID 1828 wrote to memory of 5620	1828	cmd.exe	178
PID 2532 wrote to memory of 1288	2532	4sw339d.exe	180
PID 1288 wrote to memory of 5676	1288	cmd.exe	182
PID 2532 wrote to memory of 4256	2532	4sw339d.exe	184
PID 4256 wrote to memory of 5060	4256	cmd.exe	186
PID 2532 wrote to memory of 4940	2532	4sw339d.exe	188
PID 2532 wrote to memory of 2204	2532	4sw339d.exe	192
PID 2204 wrote to memory of 2928	2204	cmd.exe	194
PID 2532 wrote to memory of 3288	2532	4sw339d.exe	196
PID 3288 wrote to memory of 3960	3288	cmd.exe	198
PID 2532 wrote to memory of 3792	2532	4sw339d.exe	200
PID 3792 wrote to memory of 2552	3792	cmd.exe	202
PID 2532 wrote to memory of 1504	2532	4sw339d.exe	204
PID 1504 wrote to memory of 2136	1504	cmd.exe	206
PID 2532 wrote to memory of 4188	2532	4sw339d.exe	208
PID 4188 wrote to memory of 3668	4188	cmd.exe	210

C:\Users\Admin\AppData\Local\Temp\4sw339d.exe
"C:\Users\Admin\AppData\Local\Temp\4sw339d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\4sw339d.exe
  "C:\Users\Admin\AppData\Local\Temp\4sw339d.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5196
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4940
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:5104
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1260
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:1204
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5700
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:1776
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3488
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4716
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3660
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5772
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:5136
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:3540
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1168
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:1660
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:2468
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5964
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:1228
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:5668
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:4648
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:1020
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3180
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:232
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:436
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:4008
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4128
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3676
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:240
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6192
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6284
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6372
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6452
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6548
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6636
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6728
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6808
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6912
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7004
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7104
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6312
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6496
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6660
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6860
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7024
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6288
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6604
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6672
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7036
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:6580
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6236
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7204
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7296
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7384
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7480
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7568
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7664
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7752
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7832
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7916
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8008
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8104
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8180
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7360
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7396
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7576
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7756
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8020
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8112
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7324
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7724
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8012
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7524
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:7216
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8120
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8200
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8312
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8392
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8484
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8580
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8684
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8768
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8864
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8956
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9044
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9132
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7224
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8336
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8528
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8708
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8820
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:9068
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9204
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8352
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8892
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9052
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8608
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8620
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9232
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:9320
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9416
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9520
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9604
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9696
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9780
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9864
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9964
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10044
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10152
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:8904
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:9240
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:9532
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9620
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9880
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10012
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10200
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9360
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3796
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:9868
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9264
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:9744
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:8376
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:9792
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:10264
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10356
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:10452
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10652
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10744
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10860
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10976
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:11064
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:11164
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10048
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:10392
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10632
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10772
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10868
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:11080
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:10280
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10664
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10980
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:10404
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:11236
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:11000
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Executes a command shell one-liner
    PID:11292
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:11380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\_bz2.pyd
Size 86KB
SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
MD5 4cc74cced07914bd71dc9c4d2a3f127a
SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
TLSH
T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\_decimal.pyd
Size 284KB
SHA256 bc3a61685825ae37a4cd2b2b87fa27af12e01575c4f920788ea806e6781a2c79
MD5 c75e9f59ed7df7cc913dc966c8caea2e
SHA1 7b3a83474270b5fecea3c4f9864cf3cf056da695
SHA512 284e0acf04cee094dc953c88d8311ab69b8ea25a844077e70d3a5d9e8531dc69ef0313ee8c2e82af6e7785dd266f565cc21306d5dac36be188c8d1be01365b5c
SSDEEP 6144:PgR0o97cPAEIiIKG5iGqqM43fIWeA5euMt7uq/X:PgR0o97cPdIiI7NO/b/X
TLSH
T1C4547D56A3490CA4EF738074CA479A57F7B2B8414360D78F43A48AA72F933A3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\_hashlib.pyd
Size 67KB
SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
MD5 3fbad145af85337e0c05dbc5ae6c0b4c
SHA1 fff5ebc3b2f044fbf024605f02a37554fded3b17
SHA512 aeaf32f2c73da687bb847bb89daf80119d5f2927b439330cb92158180b2fb48013be449228ff40d0be5833cfba3b599265cf9ee84b066f6bff9443bb9005bd65
SSDEEP 1536:OXwAzOYBQc17JKRQ+C5cIpDILyPs5i9nfIbHHnM:AJ/tJKRQ+IcIpDIJTs
TLSH
T11C635A86A6984092DA2382B5C9E34F43F974F2522B0197DF6678C18E2F233C3577B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\_lzma.pyd
Size 157KB
SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
MD5 e882005d06af06ef17b2338342b3f41e
SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
TLSH
T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\_socket.pyd
Size 85KB
SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
MD5 8e833fd16c777682dd1bb099d06390d9
SHA1 3f455b62cd6bae8f74266d371959298d70412016
SHA512 1e7d20c0ff2964f718e8387b9a74df0dd89569e2b5a817503a85e3828ddfd29d90bd6bccd7021ef574467ed72dcb8d957d13bb3039ce44ad5a06f17142643866
SSDEEP 1536:2cVuncT0XH3XAJtZypxQ7XP+66wSzj/jAjI/Lb6UaQecs8PgMrAIpGwfyPs5i9zs:vEny2+jypxQ7XPz6wSzj/jAjQLaQnsV2
TLSH
T1E3835B01A66040FAEB72C172C2639E63FBB4B5C012D4A75F1466D55A1F333D2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\_ssl.pyd
Size 186KB
SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
MD5 35cadc41cfff6464baf8d07c87daf4ec
SHA1 c497ccd0d26491530eb91bd4c671d74a4fcc936b
SHA512 3d714563a2b5cf20f7cab6f9095dfaf845cdbafc0ddd29332005a9a20136e3602c6bcc0f3eb36945afe60327acf7351168168f6e15f875ee083e63edf33ed0e6
SSDEEP 3072:MVpZeIk2MZ7IifjvQtY7qr66Xrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrUIe:2xk2MZZjvQttX4457qTVMr6
TLSH
T139147C47B5442AF7DC02E8BAC6234543FBB4F045731197DE48D6EA620F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\_zstd.pyd
Size 491KB
SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
MD5 fee9e34fa16e0ff378c281202a78d003
SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
TLSH
T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\base_library.zip
Size 1.3MB
SHA256 d7aa0c87699c53d34de91ba2e6d7813a56808cbaf24fab0ac6fedafd965237da
MD5 b9ce7d4de2a5d28ccf2e94bbf517aadd
SHA1 c5acc96173346b89811487de575cb6dbbaf9fab6
SHA512 b90f664d245462ede4ed1b628e7ae13c972e0fc7618b3045d485487634555e65a12be96bc67f1e151bd6cddaeddde35e47308f2f24f62d164e6a8398f1435997
SSDEEP 24576:xJgLFQeOdP2m2dfbYONuUFVDZGlbv3RZEdBd:i/TYCuUFVWR2dj
TLSH
T145552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\python314.dll
Size 6.5MB
SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
MD5 689a9724a63fb3b4f209c771c31d8a05
SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
TLSH
T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\select.pyd
Size 32KB
SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
MD5 72dd071ef25e5e8f5dbff53efde54825
SHA1 bbd11e454983ca8b764e32f3e5998d5d80cc94da
SHA512 d0bb4354c8c3a26b21932d26dd2d4db6e325dafec218680d333cd7507611776e32d8baf9d82d5a88f0ac2f0cdd772054399e0898c9195a07b81720bdec65e677
SSDEEP 768:SB7YTZnJrqFAIpRGayPsSvPuBL2Ip4j5Txf1mlRaX16m:SB7y5JrqFAIpRGayPs5i9jLfIY1N
TLSH
T152E28DCA6B348047EA62C571C6B2DE43FA39B7A3561186DF31B9919A0E173C1E737318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d702\unicodedata.pyd
Size 741KB
SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
MD5 71e6240fbd8f3fca694c12d8a5e3f404
SHA1 b7d66c937638526ef1a90f4dbc00ebb8a018778d
SHA512 d3a3221b28844e9801e1b6f7d6abb88ed65e8b2de8133c925f35fc12f29cc0a7e182697deead47aa4650fb00c34083cb5ca1b45f53317ffc5d22162208dbdc19
SSDEEP 12288:5IwY/APtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtygF:5IwYI5ZmDPqO54lDJPTMygF
TLSH
T132F4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download