ed53248c00dc02726e6fc8cfaaf36727b7b0d1084726437bfbe5196b3daa315c

Analysis

max time kernel
80s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 10:54

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

among_us.exe
Size

5.1MB
MD5

84ce3e9940f585471bd13aa96fa91efb
SHA1

be6f70bd54b4989d2797fe6b831aead32c8f9951
SHA256

ed53248c00dc02726e6fc8cfaaf36727b7b0d1084726437bfbe5196b3daa315c
SHA512

b63a43cbee1b247846ca5828b3ed96ce439a7a84cc2fdb4a798c809d7b2940b270540282543b3ab99e0a38dbbb3325b645bb4d1eb94f23aa1f6dd80fa6c6d2bc
SSDEEP

98304:tnVKIDTGpzoLLJ3TbwaVvrZE0I7yoFQK15W8ASLmbNYJERw1jrTHi1D1JYA:tnMIm9onJ5hrZEnyiU8AdZYJERurTUY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

among_us.exe

pid process

2144 among_us.exe
2144 among_us.exe

pid	process
2144	among_us.exe
2144	among_us.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exedwm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exedwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

Processes:

dwm.exedwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

dwm.exedwm.exe

description	pid	process
Token: SeCreateGlobalPrivilege	6984	dwm.exe
Token: SeChangeNotifyPrivilege	6984	dwm.exe
Token: 33	6984	dwm.exe
Token: SeIncBasePriorityPrivilege	6984	dwm.exe
Token: SeCreateGlobalPrivilege	16244	dwm.exe
Token: SeChangeNotifyPrivilege	16244	dwm.exe
Token: 33	16244	dwm.exe
Token: SeIncBasePriorityPrivilege	16244	dwm.exe
Token: SeCreateGlobalPrivilege	15960
Token: SeChangeNotifyPrivilege	15960
Token: 33	15960
Token: SeIncBasePriorityPrivilege	15960

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

among_us.exeamong_us.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1292 wrote to memory of 2144	1292	among_us.exe	among_us.exe
PID 1292 wrote to memory of 2144	1292	among_us.exe	among_us.exe
PID 2144 wrote to memory of 4956	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 4956	2144	among_us.exe	cmd.exe
PID 4956 wrote to memory of 5072	4956	cmd.exe	cmd.exe
PID 4956 wrote to memory of 5072	4956	cmd.exe	cmd.exe
PID 2144 wrote to memory of 1516	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 1516	2144	among_us.exe	cmd.exe
PID 1516 wrote to memory of 2712	1516	cmd.exe	cmd.exe
PID 1516 wrote to memory of 2712	1516	cmd.exe	cmd.exe
PID 2144 wrote to memory of 2792	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 2792	2144	among_us.exe	cmd.exe
PID 2792 wrote to memory of 2816	2792	cmd.exe	cmd.exe
PID 2792 wrote to memory of 2816	2792	cmd.exe	cmd.exe
PID 2144 wrote to memory of 3160	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 3160	2144	among_us.exe	cmd.exe
PID 3160 wrote to memory of 1308	3160	cmd.exe	cmd.exe
PID 3160 wrote to memory of 1308	3160	cmd.exe	cmd.exe
PID 2144 wrote to memory of 3064	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 3064	2144	among_us.exe	cmd.exe
PID 3064 wrote to memory of 3200	3064	cmd.exe	cmd.exe
PID 3064 wrote to memory of 3200	3064	cmd.exe	cmd.exe
PID 2144 wrote to memory of 2228	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 2228	2144	among_us.exe	cmd.exe
PID 2228 wrote to memory of 1688	2228	cmd.exe	cmd.exe
PID 2228 wrote to memory of 1688	2228	cmd.exe	cmd.exe
PID 2144 wrote to memory of 4884	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 4884	2144	among_us.exe	cmd.exe
PID 4884 wrote to memory of 3324	4884	cmd.exe	cmd.exe
PID 4884 wrote to memory of 3324	4884	cmd.exe	cmd.exe
PID 2144 wrote to memory of 3108	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 3108	2144	among_us.exe	cmd.exe
PID 3108 wrote to memory of 1248	3108	cmd.exe	cmd.exe
PID 3108 wrote to memory of 1248	3108	cmd.exe	cmd.exe
PID 2144 wrote to memory of 212	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 212	2144	among_us.exe	cmd.exe
PID 212 wrote to memory of 900	212	cmd.exe	cmd.exe
PID 212 wrote to memory of 900	212	cmd.exe	cmd.exe
PID 2144 wrote to memory of 1448	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 1448	2144	among_us.exe	cmd.exe
PID 1448 wrote to memory of 4980	1448	cmd.exe	cmd.exe
PID 1448 wrote to memory of 4980	1448	cmd.exe	cmd.exe
PID 2144 wrote to memory of 2720	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 2720	2144	among_us.exe	cmd.exe
PID 2720 wrote to memory of 3696	2720	cmd.exe	cmd.exe
PID 2720 wrote to memory of 3696	2720	cmd.exe	cmd.exe
PID 2144 wrote to memory of 3772	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 3772	2144	among_us.exe	cmd.exe
PID 3772 wrote to memory of 4804	3772	cmd.exe	cmd.exe
PID 3772 wrote to memory of 4804	3772	cmd.exe	cmd.exe
PID 2144 wrote to memory of 5056	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 5056	2144	among_us.exe	cmd.exe
PID 5056 wrote to memory of 1848	5056	cmd.exe	cmd.exe
PID 5056 wrote to memory of 1848	5056	cmd.exe	cmd.exe
PID 2144 wrote to memory of 5104	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 5104	2144	among_us.exe	cmd.exe
PID 5104 wrote to memory of 2732	5104	cmd.exe	cmd.exe
PID 5104 wrote to memory of 2732	5104	cmd.exe	cmd.exe
PID 2144 wrote to memory of 3752	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 3752	2144	among_us.exe	cmd.exe
PID 3752 wrote to memory of 4624	3752	cmd.exe	cmd.exe
PID 3752 wrote to memory of 4624	3752	cmd.exe	cmd.exe
PID 2144 wrote to memory of 3308	2144	among_us.exe	cmd.exe
PID 2144 wrote to memory of 3308	2144	among_us.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\among_us.exe
"C:\Users\Admin\AppData\Local\Temp\among_us.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\among_us.exe
"C:\Users\Admin\AppData\Local\Temp\among_us.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3308

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2312

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5076

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3740

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3048

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3884

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:432

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4464

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4768

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1256

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4540

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4576

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2028

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1560

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2228

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:212

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5096

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4320

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3852

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4252

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1580

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3092

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2300

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4320

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4292

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1580

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4576

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5148

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5236

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5268

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5356

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5416

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5476

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5536

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5604

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5656

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5716

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5772

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5824

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5888

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5952

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6028

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6096

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5144

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5268

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5476

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5672

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5828

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6068

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5400

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5936

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5476

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:5356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6156

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6212

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6260

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6316

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6404

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6456

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6512

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6568

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6624

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6688

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6756

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6808

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6864

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6932

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6996

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7040

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7120

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7156

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6156

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6424

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6512

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6824

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6880

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:6864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6932

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7088

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:7040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7124

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6564

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7124

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7204

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7260

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7316

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7352

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7424

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7476

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7552

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7584

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7656

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7720

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7776

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7840

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7888

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7968

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8032

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8080

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8132

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7220

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7284

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:7260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7316

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7444

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:7424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7560

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7748

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7788

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:7776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7952

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8084

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7364

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8164

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8208

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8280

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8340

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8408

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8456

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8516

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8572

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8632

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8692

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8740

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8804

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8872

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8924

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8976

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9064

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9136

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9188

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7316

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8344

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8568

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8640

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:8632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8692

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8804

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1344

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9212

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8456

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:8340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8644

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4940

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:3520

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:1344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8344

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8644

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9244

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9320

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9368

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9416

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9484

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9556

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9616

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9680

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9748

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9812

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9864

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9920

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9976

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10036

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10096

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10152

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10212

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9268

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9420

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9600

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:9556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9572

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9824

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10052

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10108

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:10096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10216

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9992

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10212

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10268

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10332

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10384

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10440

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10500

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10556

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10604

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10656

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10744

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10784

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10832

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10896

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10944

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11004

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11092

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11156

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11204

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11256

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10336

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:10332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10388

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10504

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10608

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10940

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11008

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10292

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10964

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:10940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11028

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10520

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:10292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11288

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11348

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11412

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11480

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11528

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11572

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11628

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11680

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11740

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11812

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11848

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11924

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11968

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12008

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12080

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12168

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12200

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12276

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1564

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11316

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:11288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11356

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11416

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:11480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11588

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11628

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:11680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11744

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12004

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1564

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11876

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4036

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2724

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11848

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:11876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1772

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1140

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:12012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3864

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1780

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:60

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1772

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13220

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13296

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12360

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12728

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12996

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13084

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13124

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12316

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12416

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12360

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12812

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13196

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13076

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12588

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1732

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12920

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12440

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12348

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12732

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12340

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12892

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3792

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12784

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13176

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12960

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12652

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12892

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:264

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12484

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6080

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12972

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12604

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5232

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12900

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12292

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6036

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13292

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12012

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:5136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6732

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13252

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:12456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2176

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1336

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:6076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12880

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7752

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:5232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6544

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8184

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:7992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7752

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8552

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13388

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13440

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13508

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13584

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13628

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13688

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13756

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13808

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13876

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13932

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13980

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14036

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14108

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14176

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14236

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14316

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13408

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13612

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13716

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13824

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13992

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14216

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:8764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:8808

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13652

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14020

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9176

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14368

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14440

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14504

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14560

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14672

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14732

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14812

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14876

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:14944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15544

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15600

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16124

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:16328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15484

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:13836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10160

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15832

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:2296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:6876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12428

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:4196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10792

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:16268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10392

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14016

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9376

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:10504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11636

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15960

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:3964

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:16040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:1780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16104

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:9960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12560

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:1156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15940

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16136

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:15976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:13772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:9700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:7292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:12148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:16320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:11048

C:\Windows\system32\cmd.exe
cmd /k "echo You Basted"
4⤵
PID:11532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:14272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:10740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /k "echo You Basted"
3⤵
PID:15484

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 05a9e2385b0e6f250e7c4cf5ab068e22 EPEofa9kVUei2+CbnsWHpA.0.1.0.0.0
1⤵
PID:12004

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1460

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:12632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6984

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI12922\VCRUNTIME140.dll
Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\_bz2.pyd
Filesize
83KB

MD5
6c7565c1efffe44cb0616f5b34faa628

SHA1
88dd24807da6b6918945201c74467ca75e155b99

SHA256
fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a

SHA512
822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\_decimal.pyd
Filesize
264KB

MD5
ce4df4dfe65ab8dc7ae6fcdebae46112

SHA1
cdbbfda68030394ac90f6d6249d6dd57c81bc747

SHA256
ffbe84f0a1eab363ca9cf73efb7518f2abd52c0893c7cc63266613c930855e96

SHA512
fc8e39942e46e4494356d4a45257b657495cbfa20e9d67850627e188f70b149e22603ae4801b4ba7b9a04d201b3787899d2aee21565237d18e0afce9bae33ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\_hashlib.pyd
Filesize
63KB

MD5
f377a418addeeb02f223f45f6f168fe6

SHA1
5d8d42dec5d08111e020614600bbf45091c06c0b

SHA256
9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac

SHA512
6f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\_lzma.pyd
Filesize
157KB

MD5
b5355dd319fb3c122bb7bf4598ad7570

SHA1
d7688576eceadc584388a179eed3155716c26ef5

SHA256
b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5

SHA512
0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\_socket.pyd
Filesize
77KB

MD5
f5dd9c5922a362321978c197d3713046

SHA1
4fbc2d3e15f8bb21ecc1bf492f451475204426cd

SHA256
4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

SHA512
ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\base_library.zip
Filesize
822KB

MD5
d3a47ef5b669b3ab59aa27a54b015d24

SHA1
d646309640b93ce05d268a00104d8a6ee6ee4463

SHA256
b89ba73c7ce7a7800237401b351b047996f3c975f9e6ed401864f5481acf644f

SHA512
09095fc7042a77f0c35f6a79d2c180b2660b613a82697a29662e39db80b3ed442c0433f915d17a271aba2f4f5c39615af2bac274de7095dd907413414d630dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\libcrypto-1_1.dll
Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\select.pyd
Filesize
26KB

MD5
7a442bbcc4b7aa02c762321f39487ba9

SHA1
0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

SHA256
1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

SHA512
3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12922\unicodedata.pyd
Filesize
1.1MB

MD5
8320c54418d77eba5d4553a5d6ec27f9

SHA1
e5123cf166229aebb076b469459856a56fb16d7f

SHA256
7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae

SHA512
b9e6cdcb37d26ff9c573381bda30fa4cf1730361025cd502b67288c55744962bdd0a99790cedd4a48feef3139e3903265ab112ec545cb1154eaa2a91201f6b34

Download Submit
memory/264-46-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/1324-85-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/1492-69-0x00007FFA92460000-0x00007FFA927B5000-memory.dmp

Filesize
3.3MB

Download
memory/1664-28-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/1688-31-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/1780-58-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/1996-24-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/2104-73-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/2108-88-0x00007FFA90DD0000-0x00007FFA91099000-memory.dmp

Filesize
2.8MB

Download
memory/2144-66-0x00007FFA758B0000-0x00007FFA75D1C000-memory.dmp

Filesize
4.4MB

Download
memory/2176-43-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/2576-44-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/3196-79-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/3200-30-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/3752-76-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/3752-77-0x00007FFA932D0000-0x00007FFA934C5000-memory.dmp

Filesize
2.0MB

Download
memory/3792-41-0x00007FFA90C30000-0x00007FFA90D30000-memory.dmp

Filesize
1024KB

Download
memory/3864-25-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/4240-81-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/4332-89-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/4332-74-0x00007FFA932D0000-0x00007FFA934C5000-memory.dmp

Filesize
2.0MB

Download
memory/4708-82-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/5100-27-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/5304-51-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/5520-84-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/5896-86-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/5992-83-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/6072-37-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/9684-67-0x00007FFA932D0000-0x00007FFA934C5000-memory.dmp

Filesize
2.0MB

Download
memory/10160-63-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/10740-62-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/11448-54-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/11848-26-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12356-49-0x00007FFA932D0000-0x00007FFA934C5000-memory.dmp

Filesize
2.0MB

Download
memory/12360-34-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12428-55-0x00007FFA91320000-0x00007FFA913BB000-memory.dmp

Filesize
620KB

Download
memory/12480-36-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12544-38-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12596-50-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12604-42-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12696-45-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12708-48-0x00007FFA932D0000-0x00007FFA934C5000-memory.dmp

Filesize
2.0MB

Download
memory/12708-47-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/12816-35-0x00007FFA90DD0000-0x00007FFA91099000-memory.dmp

Filesize
2.8MB

Download
memory/12900-52-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/13064-39-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/13200-40-0x00007FFA91E30000-0x00007FFA91EEE000-memory.dmp

Filesize
760KB

Download
memory/13268-32-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/13296-33-0x00007FFA92460000-0x00007FFA927B5000-memory.dmp

Filesize
3.3MB

Download
memory/14196-64-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/14796-78-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/14796-70-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/14808-87-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/15440-72-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/15688-53-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/15840-65-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/15852-75-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/15888-59-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/16036-80-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/16092-61-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/16100-56-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/16136-60-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download
memory/16140-71-0x00007FF60B200000-0x00007FF60B267000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads