051a01bdbbc480c6d589b6df08e18e0ea931ad410ceb59077a375b6fbfb2bea5

Analysis

max time kernel
126s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

game.bat
Size

1KB
MD5

afa3518b0466d1d9e3e0e25088f3a63a
SHA1

5a74fd72f1422b8d176ba0edcfddf84479056cf5
SHA256

051a01bdbbc480c6d589b6df08e18e0ea931ad410ceb59077a375b6fbfb2bea5
SHA512

eb2a54f55b5fb7e1f454f9125016f511acb633ee51ee2f7122b54bebf0a33ed749bcf12431912439b81448f08fe3b924098d1ade0164c33e6aa00d52262a73a5

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	10508	dwm.exe
Token: SeChangeNotifyPrivilege	10508	dwm.exe
Token: 33	10508	dwm.exe
Token: SeIncBasePriorityPrivilege	10508	dwm.exe
Token: SeCreateGlobalPrivilege	13504	dwm.exe
Token: SeChangeNotifyPrivilege	13504	dwm.exe
Token: 33	13504	dwm.exe
Token: SeIncBasePriorityPrivilege	13504	dwm.exe
Token: SeCreateGlobalPrivilege	14604	dwm.exe
Token: SeChangeNotifyPrivilege	14604	dwm.exe
Token: 33	14604	dwm.exe
Token: SeIncBasePriorityPrivilege	14604	dwm.exe
Token: SeShutdownPrivilege	14604	dwm.exe
Token: SeCreatePagefilePrivilege	14604	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
12436	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3524	3212	cmd.exe	84
PID 3212 wrote to memory of 3524	3212	cmd.exe	84
PID 3212 wrote to memory of 4044	3212	cmd.exe	86
PID 3212 wrote to memory of 4044	3212	cmd.exe	86
PID 3212 wrote to memory of 3196	3212	cmd.exe	88
PID 3212 wrote to memory of 3196	3212	cmd.exe	88
PID 3212 wrote to memory of 3596	3212	cmd.exe	89
PID 3212 wrote to memory of 3596	3212	cmd.exe	89
PID 3212 wrote to memory of 4488	3212	cmd.exe	91
PID 3212 wrote to memory of 4488	3212	cmd.exe	91
PID 3212 wrote to memory of 232	3212	cmd.exe	93
PID 3212 wrote to memory of 232	3212	cmd.exe	93
PID 3212 wrote to memory of 624	3212	cmd.exe	94
PID 3212 wrote to memory of 624	3212	cmd.exe	94
PID 3212 wrote to memory of 3320	3212	cmd.exe	95
PID 3212 wrote to memory of 3320	3212	cmd.exe	95
PID 3524 wrote to memory of 2964	3524	cmd.exe	100
PID 3524 wrote to memory of 2964	3524	cmd.exe	100
PID 3524 wrote to memory of 1416	3524	cmd.exe	101
PID 3524 wrote to memory of 1416	3524	cmd.exe	101
PID 3524 wrote to memory of 2336	3524	cmd.exe	102
PID 3524 wrote to memory of 2336	3524	cmd.exe	102
PID 3524 wrote to memory of 1572	3524	cmd.exe	103
PID 3524 wrote to memory of 1572	3524	cmd.exe	103
PID 3524 wrote to memory of 3584	3524	cmd.exe	104
PID 3524 wrote to memory of 3584	3524	cmd.exe	104
PID 3524 wrote to memory of 4712	3524	cmd.exe	105
PID 3524 wrote to memory of 4712	3524	cmd.exe	105
PID 3524 wrote to memory of 3244	3524	cmd.exe	106
PID 3524 wrote to memory of 3244	3524	cmd.exe	106
PID 3524 wrote to memory of 5100	3524	cmd.exe	112
PID 3524 wrote to memory of 5100	3524	cmd.exe	112
PID 3524 wrote to memory of 3432	3524	cmd.exe	117
PID 3524 wrote to memory of 3432	3524	cmd.exe	117
PID 3524 wrote to memory of 924	3524	cmd.exe	118
PID 3524 wrote to memory of 924	3524	cmd.exe	118
PID 3212 wrote to memory of 2676	3212	cmd.exe	116
PID 3212 wrote to memory of 2676	3212	cmd.exe	116
PID 3524 wrote to memory of 3728	3524	cmd.exe	122
PID 3524 wrote to memory of 3728	3524	cmd.exe	122
PID 3596 wrote to memory of 888	3596	cmd.exe	124
PID 3596 wrote to memory of 888	3596	cmd.exe	124
PID 232 wrote to memory of 2500	232	cmd.exe	125
PID 232 wrote to memory of 2500	232	cmd.exe	125
PID 3596 wrote to memory of 1800	3596	cmd.exe	127
PID 3596 wrote to memory of 1800	3596	cmd.exe	127
PID 3320 wrote to memory of 2924	3320	cmd.exe	126
PID 3320 wrote to memory of 2924	3320	cmd.exe	126
PID 3596 wrote to memory of 4300	3596	cmd.exe	130
PID 3596 wrote to memory of 4300	3596	cmd.exe	130
PID 232 wrote to memory of 3536	232	cmd.exe	131
PID 232 wrote to memory of 3536	232	cmd.exe	131
PID 3320 wrote to memory of 876	3320	cmd.exe	135
PID 3320 wrote to memory of 876	3320	cmd.exe	135
PID 3596 wrote to memory of 4700	3596	cmd.exe	136
PID 3596 wrote to memory of 4700	3596	cmd.exe	136
PID 3212 wrote to memory of 4024	3212	cmd.exe	133
PID 3212 wrote to memory of 4024	3212	cmd.exe	133
PID 3212 wrote to memory of 3112	3212	cmd.exe	141
PID 3212 wrote to memory of 3112	3212	cmd.exe	141
PID 3196 wrote to memory of 1184	3196	cmd.exe	138
PID 3196 wrote to memory of 1184	3196	cmd.exe	138
PID 4044 wrote to memory of 672	4044	cmd.exe	147
PID 4044 wrote to memory of 672	4044	cmd.exe	147

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\game.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8404
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10432
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:1416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:1792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10236
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3220
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11976
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13280
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11568
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:11516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13788
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15036
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:16028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:8648
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4732
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:1644
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:2300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:1480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:2336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:1484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:4996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8292
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:3208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:1572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14504
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15248
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15920
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15076
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:7876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:12728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:14820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:15096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:4712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:1056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7620
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:9704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13652
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14464
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15288
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12496
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:15564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:10848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:13448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:13820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:8980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:14492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:10308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        8⤵
        
        PID:1108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        9⤵
        
        PID:11088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        9⤵
        
        PID:14468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        9⤵
        
        PID:13620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        9⤵
        
        PID:15660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:14016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:11648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:15700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:3948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:14792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:13756
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:8424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:380
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:3736
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:2076
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:12400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10344
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:13164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15760
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10260
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15344
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:1716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:5020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:1708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3032
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:13176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:2508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:6532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12896
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:4480
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:10972
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 10972 -s 392
        8⤵
        
        PID:12484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:6940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13816
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9748
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12848
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:12956
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:1572
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7228
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12712
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:8388
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:11204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:2044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:4924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13304
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:11220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:2600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5984
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:1692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13480
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:7068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:13252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:1628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:15384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        8⤵
        
        PID:13756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:12944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:14872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3236
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:15884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:13620
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:7572
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12788
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12500
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11088
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14356
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14112
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:9980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:4484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:1784
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:11212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14328
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:6976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:1344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:4620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14076
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:13060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:4388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11828
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:6740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:11324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:1184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:6452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:11048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:1800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:5356
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:14476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:4300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9816
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:9704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12328
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:13288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:4700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:4552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:16164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:1184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:6196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:6220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:2500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11696
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12192
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:11268
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14000
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15264
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15616
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:9980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        7⤵
        
        PID:2536
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12392
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:12652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:6660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:4604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:11408
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:12532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:11848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:13756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:16056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:6124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:2924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11196
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:12952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:1708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:7352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:3236
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:13948
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15136
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:10924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:12784
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:14104
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        6⤵
        
        PID:15976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:3944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:9672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12836
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:12392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12984
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:8664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:3948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:2904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:15100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:3260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:4732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:12160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:7876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:8916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13252
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:12920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:13100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:14672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:16252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:10724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:9740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:12648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:9936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:2044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:11260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10092
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:11892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K game.bat
        5⤵
        
        PID:11412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:5616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:7584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:11728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:10204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:6788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:11212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:9976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:13048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:6276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:7824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:12608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:13644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:14664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:5016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:14820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:13420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:8916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:15212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:14324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:14288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:15448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K game.bat
      4⤵
      PID:12596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:16368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:9328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:14376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:15008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:14724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:14604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:14952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:16308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:13060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:12740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K game.bat
  2⤵
  PID:8868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:10972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:11892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K game.bat
    3⤵
    PID:8676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:11352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 904 -p 10228 -ip 10228
  2⤵
  PID:11716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 11896 -s 392
1⤵
PID:8148

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10508

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 14260 -s 388
1⤵
PID:13756

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13504

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14604

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:12436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads