99fa5ff5b44e87d2af5645a573e2786f58d76065d25a1530e7c7a0ff72d858a4

Analysis

max time kernel
148s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

069930e312b516a91e6b157af6696972_JaffaCakes118.exe
Size

62KB
MD5

069930e312b516a91e6b157af6696972
SHA1

a4f2954a404c1362fbe48c2b685b9fabfb6ebf9c
SHA256

99fa5ff5b44e87d2af5645a573e2786f58d76065d25a1530e7c7a0ff72d858a4
SHA512

b833b0cbf5785f2cd550013ca20f10eb30df37b335ea71f7a7ced5a701bd2439e8635f79baf19fb82650b1a0ec7a7690866246b3c4287ffbe0e0b4e1939a3957
SSDEEP

1536:LlqAd1s1p5h8B4/M8pQA80SkvKjRevw3u5:/d1aq5GQA80NvKjRevw3u5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4440	EXPL0RER.EXE
2360	EXPL0RER.EXE
3976	EXPL0RER.EXE
4532	EXPL0RER.EXE
3420	EXPL0RER.EXE
1520	EXPL0RER.EXE
832	EXPL0RER.EXE
4164	EXPL0RER.EXE
3596	EXPL0RER.EXE
3100	EXPL0RER.EXE
3368	EXPL0RER.EXE
1876	EXPL0RER.EXE
5064	EXPL0RER.EXE
4508	EXPL0RER.EXE
3428	EXPL0RER.EXE
4776	EXPL0RER.EXE
4784	EXPL0RER.EXE
5000	EXPL0RER.EXE
2884	EXPL0RER.EXE
3620	EXPL0RER.EXE
2028	EXPL0RER.EXE
224	EXPL0RER.EXE
2676	EXPL0RER.EXE
3972	EXPL0RER.EXE
116	EXPL0RER.EXE
3944	EXPL0RER.EXE
5064	EXPL0RER.EXE
4264	EXPL0RER.EXE
2716	EXPL0RER.EXE
3340	EXPL0RER.EXE
2820	EXPL0RER.EXE
1368	EXPL0RER.EXE
5064	EXPL0RER.EXE
3972	EXPL0RER.EXE
5172	EXPL0RER.EXE
5312	EXPL0RER.EXE
5440	EXPL0RER.EXE
5580	EXPL0RER.EXE
5716	EXPL0RER.EXE
5852	EXPL0RER.EXE
5976	EXPL0RER.EXE
6140	EXPL0RER.EXE
3424	EXPL0RER.EXE
5460	EXPL0RER.EXE
5532	EXPL0RER.EXE
5816	EXPL0RER.EXE
6072	EXPL0RER.EXE
5260	EXPL0RER.EXE
5768	EXPL0RER.EXE
5460	EXPL0RER.EXE
5832	EXPL0RER.EXE
4340	EXPL0RER.EXE
5648	EXPL0RER.EXE
5584	EXPL0RER.EXE
5132	EXPL0RER.EXE
5648	EXPL0RER.EXE
3140	EXPL0RER.EXE
6196	EXPL0RER.EXE
6328	EXPL0RER.EXE
6472	EXPL0RER.EXE
6600	EXPL0RER.EXE
6744	EXPL0RER.EXE
6872	EXPL0RER.EXE
7004	EXPL0RER.EXE

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE

Program crash 63 IoCs

pid	pid_target	Process	procid_target
7372	7344	WerFault.exe	493
11116	10852	WerFault.exe	754
11232	10972	WerFault.exe	758
10396	11104	WerFault.exe	762
10304	11224	WerFault.exe	766
10752	4456	WerFault.exe	771
10920	10308	WerFault.exe	774
11156	10748	WerFault.exe	778
10276	10728	WerFault.exe	783
10600	11140	WerFault.exe	786
11136	9960	WerFault.exe	791
10112	10616	WerFault.exe	795
1748	10832	WerFault.exe	799
10600	10368	WerFault.exe	803
11260	10936	WerFault.exe	807
10312	11088	WerFault.exe	811
10380	10920	WerFault.exe	816
10600	10704	WerFault.exe	819
11352	10484	WerFault.exe	823
11512	9492	WerFault.exe	827
11644	11388	WerFault.exe	832
11780	11528	WerFault.exe	836
11920	11664	WerFault.exe	840
12064	11788	WerFault.exe	844
12180	11912	WerFault.exe	847
11260	12032	WerFault.exe	851
10600	12172	WerFault.exe	855
11684	11128	WerFault.exe	859
11936	10304	WerFault.exe	864
12088	11692	WerFault.exe	868
12260	11656	WerFault.exe	871
11356	12052	WerFault.exe	875
11836	12144	WerFault.exe	879
12072	11488	WerFault.exe	884
11924	11744	WerFault.exe	887
11648	11904	WerFault.exe	891
10360	11396	WerFault.exe	896
6044	11660	WerFault.exe	900
11748	11640	WerFault.exe	903
11372	10380	WerFault.exe	908
12316	11636	WerFault.exe	912
12416	11552	WerFault.exe	916
12544	11648	WerFault.exe	919
12688	12444	WerFault.exe	924
12840	12564	WerFault.exe	928
12960	12712	WerFault.exe	932
13092	12828	WerFault.exe	935
13224	12952	WerFault.exe	939
12228	13104	WerFault.exe	944
12556	13232	WerFault.exe	948
12736	12304	WerFault.exe	952
12936	12336	WerFault.exe	955
12940	12728	WerFault.exe	959
10600	12880	WerFault.exe	963
12520	13136	WerFault.exe	968
12696	13276	WerFault.exe	971
12932	12412	WerFault.exe	976
12524	12688	WerFault.exe	979
12792	13148	WerFault.exe	983
14728	13924	WerFault.exe	1222
14688	15024	WerFault.exe	1227
14728	15020	WerFault.exe	1230
12860	15096	WerFault.exe	1235

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 1688	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	84
PID 3424 wrote to memory of 1688	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	84
PID 3424 wrote to memory of 1688	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	84
PID 3424 wrote to memory of 4440	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	85
PID 3424 wrote to memory of 4440	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	85
PID 3424 wrote to memory of 4440	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	85
PID 3424 wrote to memory of 5056	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	87
PID 3424 wrote to memory of 5056	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	87
PID 3424 wrote to memory of 5056	3424	069930e312b516a91e6b157af6696972_JaffaCakes118.exe	87
PID 4440 wrote to memory of 3956	4440	EXPL0RER.EXE	88
PID 4440 wrote to memory of 3956	4440	EXPL0RER.EXE	88
PID 4440 wrote to memory of 3956	4440	EXPL0RER.EXE	88
PID 4440 wrote to memory of 2360	4440	EXPL0RER.EXE	89
PID 4440 wrote to memory of 2360	4440	EXPL0RER.EXE	89
PID 4440 wrote to memory of 2360	4440	EXPL0RER.EXE	89
PID 4440 wrote to memory of 4964	4440	EXPL0RER.EXE	91
PID 4440 wrote to memory of 4964	4440	EXPL0RER.EXE	91
PID 4440 wrote to memory of 4964	4440	EXPL0RER.EXE	91
PID 2360 wrote to memory of 4044	2360	EXPL0RER.EXE	92
PID 2360 wrote to memory of 4044	2360	EXPL0RER.EXE	92
PID 2360 wrote to memory of 4044	2360	EXPL0RER.EXE	92
PID 2360 wrote to memory of 3976	2360	EXPL0RER.EXE	93
PID 2360 wrote to memory of 3976	2360	EXPL0RER.EXE	93
PID 2360 wrote to memory of 3976	2360	EXPL0RER.EXE	93
PID 2360 wrote to memory of 2984	2360	EXPL0RER.EXE	95
PID 2360 wrote to memory of 2984	2360	EXPL0RER.EXE	95
PID 2360 wrote to memory of 2984	2360	EXPL0RER.EXE	95
PID 3976 wrote to memory of 1480	3976	EXPL0RER.EXE	96
PID 3976 wrote to memory of 1480	3976	EXPL0RER.EXE	96
PID 3976 wrote to memory of 1480	3976	EXPL0RER.EXE	96
PID 3976 wrote to memory of 4532	3976	EXPL0RER.EXE	97
PID 3976 wrote to memory of 4532	3976	EXPL0RER.EXE	97
PID 3976 wrote to memory of 4532	3976	EXPL0RER.EXE	97
PID 3976 wrote to memory of 4480	3976	EXPL0RER.EXE	99
PID 3976 wrote to memory of 4480	3976	EXPL0RER.EXE	99
PID 3976 wrote to memory of 4480	3976	EXPL0RER.EXE	99
PID 4532 wrote to memory of 4280	4532	EXPL0RER.EXE	100
PID 4532 wrote to memory of 4280	4532	EXPL0RER.EXE	100
PID 4532 wrote to memory of 4280	4532	EXPL0RER.EXE	100
PID 4532 wrote to memory of 3420	4532	EXPL0RER.EXE	102
PID 4532 wrote to memory of 3420	4532	EXPL0RER.EXE	102
PID 4532 wrote to memory of 3420	4532	EXPL0RER.EXE	102
PID 4532 wrote to memory of 1932	4532	EXPL0RER.EXE	103
PID 4532 wrote to memory of 1932	4532	EXPL0RER.EXE	103
PID 4532 wrote to memory of 1932	4532	EXPL0RER.EXE	103
PID 3420 wrote to memory of 3996	3420	EXPL0RER.EXE	104
PID 3420 wrote to memory of 3996	3420	EXPL0RER.EXE	104
PID 3420 wrote to memory of 3996	3420	EXPL0RER.EXE	104
PID 3420 wrote to memory of 1520	3420	EXPL0RER.EXE	105
PID 3420 wrote to memory of 1520	3420	EXPL0RER.EXE	105
PID 3420 wrote to memory of 1520	3420	EXPL0RER.EXE	105
PID 3420 wrote to memory of 4872	3420	EXPL0RER.EXE	106
PID 3420 wrote to memory of 4872	3420	EXPL0RER.EXE	106
PID 3420 wrote to memory of 4872	3420	EXPL0RER.EXE	106
PID 1520 wrote to memory of 456	1520	EXPL0RER.EXE	107
PID 1520 wrote to memory of 456	1520	EXPL0RER.EXE	107
PID 1520 wrote to memory of 456	1520	EXPL0RER.EXE	107
PID 1520 wrote to memory of 832	1520	EXPL0RER.EXE	150
PID 1520 wrote to memory of 832	1520	EXPL0RER.EXE	150
PID 1520 wrote to memory of 832	1520	EXPL0RER.EXE	150
PID 1520 wrote to memory of 5100	1520	EXPL0RER.EXE	109
PID 1520 wrote to memory of 5100	1520	EXPL0RER.EXE	109
PID 1520 wrote to memory of 5100	1520	EXPL0RER.EXE	109
PID 832 wrote to memory of 2068	832	EXPL0RER.EXE	110

C:\Users\Admin\AppData\Local\Temp\069930e312b516a91e6b157af6696972_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\069930e312b516a91e6b157af6696972_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
  2⤵
  PID:1688
- C:\Windows\SysWOW64\EXPL0RER.EXE
  C:\Windows\system32\EXPL0RER.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\EXPL0RER.EXE
    C:\Windows\system32\EXPL0RER.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
      4⤵
      PID:4044
  - - C:\Windows\SysWOW64\EXPL0RER.EXE
      C:\Windows\system32\EXPL0RER.EXE
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        5⤵
        
        PID:1480
    - - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        6⤵
        
        PID:4280
      - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        7⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        8⤵
        
        PID:456
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        9⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        9⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        10⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        10⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3596
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        11⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        11⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        12⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        13⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        13⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        14⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        14⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5064
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        15⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        15⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        16⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        16⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        17⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4776
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        18⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        18⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        19⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5000
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        20⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2884
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        21⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        21⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3620
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        22⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        23⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        23⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        24⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2676
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        25⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        25⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        26⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        26⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        27⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        27⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        28⤵
        
        PID:516
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5064
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        29⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4264
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        30⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        30⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        31⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        31⤵
        Executes dropped EXE
        
        PID:3340
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        32⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        32⤵
        Executes dropped EXE
        
        PID:2820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        33⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        33⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        34⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        34⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5064
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        35⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        35⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        36⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        36⤵
        Executes dropped EXE
        
        PID:5172
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        37⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        38⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        39⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        39⤵
        Executes dropped EXE
        
        PID:5580
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        40⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        40⤵
        Executes dropped EXE
        
        PID:5716
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        41⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        41⤵
        Executes dropped EXE
        
        PID:5852
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        42⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        42⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5976
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        43⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        43⤵
        Executes dropped EXE
        
        PID:6140
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        44⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        44⤵
        Executes dropped EXE
        
        PID:3424
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        45⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        45⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5460
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        46⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        46⤵
        Executes dropped EXE
        
        PID:5532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        47⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        47⤵
        Executes dropped EXE
        
        PID:5816
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        48⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        48⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6072
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        49⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        49⤵
        Executes dropped EXE
        
        PID:5260
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        50⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        50⤵
        Executes dropped EXE
        
        PID:5768
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        51⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5460
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        52⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        52⤵
        Executes dropped EXE
        
        PID:5832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        53⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        54⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        55⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        55⤵
        Executes dropped EXE
        
        PID:5584
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        56⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        57⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        57⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5648
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        58⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        58⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3140
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        59⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        59⤵
        Executes dropped EXE
        
        PID:6196
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        60⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        60⤵
        Executes dropped EXE
        
        PID:6328
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        61⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        61⤵
        Executes dropped EXE
        
        PID:6472
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        62⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        63⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        64⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        65⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        65⤵
        Executes dropped EXE
        
        PID:7004
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        66⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        66⤵
        Drops file in Windows directory
        
        PID:7160
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        67⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        67⤵
        Drops file in Windows directory
        
        PID:6292
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        68⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        68⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        69⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        69⤵
        Drops file in Windows directory
        
        PID:6628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        70⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        70⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        71⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        71⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        72⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        72⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        73⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        73⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        74⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        74⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        75⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        75⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        76⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        76⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        77⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        77⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        78⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        78⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        79⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        79⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6492
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        80⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        80⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        81⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        81⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        82⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        82⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        83⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        83⤵
        Drops file in Windows directory
        
        PID:4600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        84⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        84⤵
        Drops file in Windows directory
        
        PID:6820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        85⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        85⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        86⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        86⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        87⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        87⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        88⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        88⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        89⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        89⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:7716
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        90⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        90⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        91⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        91⤵
        Drops file in Windows directory
        
        PID:7988
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        92⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        92⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        93⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        93⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        94⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        94⤵
        Drops file in Windows directory
        
        PID:7452
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        95⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        95⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        96⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        96⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        97⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        97⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        98⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        98⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        99⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        99⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        100⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        100⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        101⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        101⤵
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        102⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        102⤵
        Drops file in System32 directory
        
        PID:7344
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        103⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        103⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        104⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        104⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        105⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        105⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        106⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        106⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        107⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        107⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        108⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        108⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:7356
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        109⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        109⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        110⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        110⤵
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        111⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        111⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        112⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        112⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        113⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        113⤵
        Drops file in System32 directory
        
        PID:8744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        114⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        114⤵
        Drops file in Windows directory
        
        PID:8860
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        115⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        115⤵
        Drops file in Windows directory
        
        PID:9004
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        116⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        116⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        117⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        117⤵
        Drops file in Windows directory
        
        PID:7356
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        118⤵
        
        PID:400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        118⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        119⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        119⤵
        Drops file in System32 directory
        
        PID:8696
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        120⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        120⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        121⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        121⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        122⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        122⤵
        Drops file in Windows directory
        
        PID:9008
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        123⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        123⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        124⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        124⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        125⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        125⤵
        Drops file in Windows directory
        
        PID:8428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        126⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        126⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        127⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        127⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        128⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        128⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        129⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        129⤵
        Drops file in Windows directory
        
        PID:540
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        130⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        130⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:9140
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        131⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        131⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        132⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        132⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        133⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        133⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        134⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        134⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        135⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        135⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        136⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        136⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        137⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        137⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        138⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        138⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        139⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        139⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:9604
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        140⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        140⤵
        Drops file in System32 directory
        
        PID:9728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        141⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        141⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        142⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        142⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        143⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        143⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        144⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        144⤵
        Drops file in Windows directory
        
        PID:2812
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        145⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        145⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        146⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        146⤵
        Drops file in Windows directory
        
        PID:9448
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        147⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        147⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        148⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        148⤵
        Drops file in System32 directory
        
        PID:9784
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        149⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        149⤵
        Drops file in System32 directory
        
        PID:9828
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        150⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        150⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        151⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        151⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        152⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        152⤵
        Drops file in Windows directory
        
        PID:9376
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        153⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        153⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        154⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        154⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        155⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        155⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        156⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        156⤵
        Drops file in Windows directory
        
        PID:9760
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        157⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        157⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        158⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        158⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        159⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        159⤵
        Drops file in System32 directory
        
        PID:9480
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        160⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        160⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        161⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        161⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        162⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        162⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        163⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        163⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        164⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        164⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        165⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        165⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        166⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        166⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        167⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        167⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        168⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        168⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        169⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        169⤵
        Drops file in System32 directory
        
        PID:11104
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        170⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        170⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        171⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        171⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        172⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        172⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        173⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        173⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        174⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        174⤵
        Drops file in Windows directory
        
        PID:10728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        175⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        175⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        176⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        176⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        177⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        177⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        178⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        178⤵
        Drops file in Windows directory
        
        PID:10832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        179⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        179⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        180⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        180⤵
        Drops file in System32 directory
        
        PID:10936
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        181⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        181⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        182⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        182⤵
        Drops file in Windows directory
        
        PID:10920
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        183⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        183⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        184⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        184⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        185⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        185⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        186⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        186⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        187⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        187⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        188⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        188⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        189⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        189⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        190⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        190⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        191⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        191⤵
        Drops file in System32 directory
        
        PID:12032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        192⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        192⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        193⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        193⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        194⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        194⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        195⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        195⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        196⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        196⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        197⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        197⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        198⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        198⤵
        Drops file in Windows directory
        
        PID:12144
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        199⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        199⤵
        Drops file in System32 directory
        
        PID:11488
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        200⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        200⤵
        Drops file in Windows directory
        
        PID:11744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        201⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        201⤵
        Drops file in System32 directory
        
        PID:11904
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        202⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        202⤵
        Drops file in Windows directory
        
        PID:11396
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        203⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        203⤵
        Drops file in System32 directory
        
        PID:11660
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        204⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        204⤵
        Drops file in System32 directory
        
        PID:11640
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        205⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        205⤵
        Drops file in System32 directory
        
        PID:10380
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        206⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        206⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        207⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        207⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        208⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        208⤵
        Drops file in Windows directory
        
        PID:11648
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        209⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        209⤵
        Drops file in Windows directory
        
        PID:12444
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        210⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        210⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        211⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        211⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:12712
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        212⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        212⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        213⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        213⤵
        Drops file in Windows directory
        
        PID:12952
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        214⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        214⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        215⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        215⤵
        Drops file in Windows directory
        
        PID:13232
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        216⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        216⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        217⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        217⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        218⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        218⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        219⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        219⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        220⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        220⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        221⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        221⤵
        Drops file in Windows directory
        
        PID:13276
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        222⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        222⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        223⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        223⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        224⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        224⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        225⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        225⤵
        Drops file in Windows directory
        
        PID:12456
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        226⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        226⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        227⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        227⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        228⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        228⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        229⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        229⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        230⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        230⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        231⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        231⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        232⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        232⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        233⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        233⤵
        Drops file in Windows directory
        
        PID:12860
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        234⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        234⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        235⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        235⤵
        Drops file in System32 directory
        
        PID:12704
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        236⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        236⤵
        Drops file in System32 directory
        
        PID:13356
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        237⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        237⤵
        
        PID:13536
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        238⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        238⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        239⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        239⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        240⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        240⤵
        
        PID:13880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        241⤵
        
        PID:13976
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        241⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        242⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        242⤵
        Drops file in System32 directory
        
        PID:14136
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        243⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        243⤵
        Drops file in System32 directory
        
        PID:14264
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        244⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        244⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        245⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        245⤵
        Drops file in System32 directory
        
        PID:13532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        246⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        246⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        247⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        247⤵
        Drops file in Windows directory
        
        PID:13736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        248⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        248⤵
        
        PID:13948
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        249⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        249⤵
        Drops file in System32 directory
        
        PID:14256
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        250⤵
        
        PID:13336
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        250⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        251⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        251⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        252⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        252⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        253⤵
        
        PID:13844
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        253⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        254⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        254⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        255⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        255⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:12856
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        256⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        256⤵
        
        PID:13844
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        257⤵
        
        PID:14216
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        257⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        258⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        258⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        259⤵
        
        PID:14216
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        259⤵
        
        PID:14084
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        260⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        260⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        261⤵
        
        PID:14276
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        261⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        262⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        262⤵
        Drops file in System32 directory
        
        PID:12392
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        263⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        263⤵
        Drops file in Windows directory
        
        PID:13388
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        264⤵
        
        PID:14380
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        264⤵
        Drops file in Windows directory
        
        PID:14420
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        265⤵
        
        PID:14516
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        265⤵
        Drops file in System32 directory
        
        PID:14532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        266⤵
        
        PID:14624
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        266⤵
        
        PID:14640
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        267⤵
        
        PID:14756
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        267⤵
        Drops file in Windows directory
        
        PID:14772
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        268⤵
        
        PID:14884
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        268⤵
        
        PID:14912
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        269⤵
        
        PID:15016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        269⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:15036
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        270⤵
        
        PID:15120
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        270⤵
        Drops file in Windows directory
        
        PID:15140
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        271⤵
        
        PID:15272
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        271⤵
        
        PID:15308
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        272⤵
        
        PID:14096
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        272⤵
        
        PID:14380
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        273⤵
        
        PID:14604
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        273⤵
        
        PID:14464
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        274⤵
        
        PID:14740
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        274⤵
        
        PID:14532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        275⤵
        
        PID:14944
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        275⤵
        
        PID:14832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        276⤵
        
        PID:15100
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        276⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:14980
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        277⤵
        
        PID:15088
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        277⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        278⤵
        
        PID:14500
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        278⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        279⤵
        
        PID:14752
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        279⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        280⤵
        
        PID:14964
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        280⤵
        
        PID:14856
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        281⤵
        
        PID:14920
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        281⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        282⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        282⤵
        
        PID:14468
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        283⤵
        
        PID:14560
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        283⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        284⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        284⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        285⤵
        
        PID:14792
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        285⤵
        
        PID:15024
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        286⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        286⤵
        
        PID:15020
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        287⤵
        
        PID:14792
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        287⤵
        Drops file in System32 directory
        
        PID:15096
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        288⤵
        
        PID:15300
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        288⤵
        
        PID:576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15096 -s 1216
        288⤵
        Program crash
        
        PID:12860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15020 -s 1244
        287⤵
        Program crash
        
        PID:14728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15024 -s 1252
        286⤵
        Program crash
        
        PID:14688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13924 -s 1220
        285⤵
        Program crash
        
        PID:14728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        284⤵
        
        PID:14480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        283⤵
        
        PID:14672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        282⤵
        
        PID:14664
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        283⤵
        
        PID:14640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        281⤵
        
        PID:13800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        280⤵
        
        PID:14972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        279⤵
        
        PID:14940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        278⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        277⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        276⤵
        
        PID:15268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        275⤵
        
        PID:15072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        274⤵
        
        PID:14884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        273⤵
        
        PID:14580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        272⤵
        
        PID:14576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        271⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        270⤵
        
        PID:15260
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        271⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        269⤵
        
        PID:15108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        268⤵
        
        PID:15004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        267⤵
        
        PID:14872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        266⤵
        
        PID:14744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        265⤵
        
        PID:14612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        264⤵
        
        PID:14504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        263⤵
        
        PID:14368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        262⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        261⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        260⤵
        
        PID:232
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        261⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        259⤵
        
        PID:1704
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        260⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        258⤵
        
        PID:13068
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        259⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        257⤵
        
        PID:14288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        256⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        255⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        254⤵
        
        PID:12704
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        255⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        253⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        252⤵
        
        PID:14088
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        253⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        251⤵
        
        PID:13668
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        252⤵
        
        PID:13536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        250⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        249⤵
        
        PID:12340
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        250⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        248⤵
        
        PID:14100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        247⤵
        
        PID:14032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        246⤵
        
        PID:13716
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        247⤵
        
        PID:13976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        245⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        244⤵
        
        PID:13124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        245⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        243⤵
        
        PID:4352
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        244⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        242⤵
        
        PID:14236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        241⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        240⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        239⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        238⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        237⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        236⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        235⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        234⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        233⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        232⤵
        
        PID:12684
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        233⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        231⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        230⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        229⤵
        
        PID:12552
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        230⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        228⤵
        
        PID:12612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        229⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        227⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        226⤵
        
        PID:12012
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        227⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13148 -s 1108
        225⤵
        Program crash
        
        PID:12792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12688 -s 1256
        224⤵
        Program crash
        
        PID:12524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12412 -s 1252
        223⤵
        Program crash
        
        PID:12932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13276 -s 1256
        222⤵
        Program crash
        
        PID:12696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13136 -s 1252
        221⤵
        Program crash
        
        PID:12520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12880 -s 1172
        220⤵
        Program crash
        
        PID:10600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12728 -s 1280
        219⤵
        Program crash
        
        PID:12940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12336 -s 1184
        218⤵
        Program crash
        
        PID:12936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12304 -s 1264
        217⤵
        Program crash
        
        PID:12736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13232 -s 1260
        216⤵
        Program crash
        
        PID:12556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13104 -s 1176
        215⤵
        Program crash
        
        PID:12228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12952 -s 1256
        214⤵
        Program crash
        
        PID:13224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12828 -s 1236
        213⤵
        Program crash
        
        PID:13092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12712 -s 1188
        212⤵
        Program crash
        
        PID:12960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12564 -s 1228
        211⤵
        Program crash
        
        PID:12840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12444 -s 1260
        210⤵
        Program crash
        
        PID:12688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11648 -s 1268
        209⤵
        Program crash
        
        PID:12544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11552 -s 1256
        208⤵
        Program crash
        
        PID:12416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11636 -s 1216
        207⤵
        Program crash
        
        PID:12316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10380 -s 1216
        206⤵
        Program crash
        
        PID:11372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11640 -s 1260
        205⤵
        Program crash
        
        PID:11748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11660 -s 1256
        204⤵
        Program crash
        
        PID:6044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11396 -s 1256
        203⤵
        Program crash
        
        PID:10360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11904 -s 1256
        202⤵
        Program crash
        
        PID:11648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11744 -s 1260
        201⤵
        Program crash
        
        PID:11924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11488 -s 1160
        200⤵
        Program crash
        
        PID:12072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12144 -s 1244
        199⤵
        Program crash
        
        PID:11836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12052 -s 1248
        198⤵
        Program crash
        
        PID:11356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11656 -s 1260
        197⤵
        Program crash
        
        PID:12260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11692 -s 1224
        196⤵
        Program crash
        
        PID:12088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10304 -s 1216
        195⤵
        Program crash
        
        PID:11936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11128 -s 1276
        194⤵
        Program crash
        
        PID:11684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12172 -s 1268
        193⤵
        Program crash
        
        PID:10600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12032 -s 1244
        192⤵
        Program crash
        
        PID:11260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11912 -s 1228
        191⤵
        Program crash
        
        PID:12180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11788 -s 1268
        190⤵
        Program crash
        
        PID:12064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11664 -s 1268
        189⤵
        Program crash
        
        PID:11920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11528 -s 1272
        188⤵
        Program crash
        
        PID:11780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11388 -s 1272
        187⤵
        Program crash
        
        PID:11644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9492 -s 1224
        186⤵
        Program crash
        
        PID:11512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10484 -s 1248
        185⤵
        Program crash
        
        PID:11352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10704 -s 1268
        184⤵
        Program crash
        
        PID:10600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10920 -s 1252
        183⤵
        Program crash
        
        PID:10380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11088 -s 1268
        182⤵
        Program crash
        
        PID:10312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10936 -s 1252
        181⤵
        Program crash
        
        PID:11260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10368 -s 1264
        180⤵
        Program crash
        
        PID:10600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10832 -s 1260
        179⤵
        Program crash
        
        PID:1748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10616 -s 1080
        178⤵
        Program crash
        
        PID:10112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9960 -s 1168
        177⤵
        Program crash
        
        PID:11136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11140 -s 1256
        176⤵
        Program crash
        
        PID:10600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10728 -s 1264
        175⤵
        Program crash
        
        PID:10276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10748 -s 1260
        174⤵
        Program crash
        
        PID:11156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10308 -s 1264
        173⤵
        Program crash
        
        PID:10920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 1276
        172⤵
        Program crash
        
        PID:10752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11224 -s 1276
        171⤵
        Program crash
        
        PID:10304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11104 -s 1248
        170⤵
        Program crash
        
        PID:10396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10972 -s 1248
        169⤵
        Program crash
        
        PID:11232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 1252
        168⤵
        Program crash
        
        PID:11116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        167⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        166⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        165⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        164⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        163⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        162⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        161⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        160⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        159⤵
        
        PID:8
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        158⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        157⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        156⤵
        
        PID:10016
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        157⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        155⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        154⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        153⤵
        
        PID:9260
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        154⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        152⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        151⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        150⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        149⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        148⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        147⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        146⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        145⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        144⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        143⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        142⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        141⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        140⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        139⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        138⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        137⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        136⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        135⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        134⤵
        
        PID:8756
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        135⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        133⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        132⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        131⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        130⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        129⤵
        
        PID:956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        128⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        127⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        126⤵
        
        PID:9204
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        127⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        125⤵
        
        PID:8896
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        126⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        124⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        123⤵
        
        PID:8620
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        124⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        122⤵
        
        PID:7492
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        123⤵
        
        PID:400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        121⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        120⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        119⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        118⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        117⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        116⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        115⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        114⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        113⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        112⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        111⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        110⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        109⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        108⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        107⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        106⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        105⤵
        
        PID:7756
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        106⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        104⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1264
        103⤵
        Program crash
        
        PID:7372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        102⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        101⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        100⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        99⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        98⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        97⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        96⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        95⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        94⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        93⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        92⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        91⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        90⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        89⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        88⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        87⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        86⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        85⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        84⤵
        
        PID:6896
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        85⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        83⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        82⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        81⤵
        
        PID:6640
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        82⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        80⤵
        
        PID:6768
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        81⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        79⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        78⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        77⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        76⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        75⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        74⤵
        
        PID:6704
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        75⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        73⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        72⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        71⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        70⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        69⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        68⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        67⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        66⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        65⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        64⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        63⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        62⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        61⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        60⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        59⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        58⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        57⤵
        
        PID:5584
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        58⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        56⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        55⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        54⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        53⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        52⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        51⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        50⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        49⤵
        
        PID:2716
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        50⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        48⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        47⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        46⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        45⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        44⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        43⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        42⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        41⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        40⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        39⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        38⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        37⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        36⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        35⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        34⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        33⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        32⤵
        
        PID:1264
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        31⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        30⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        29⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        28⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        27⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        26⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        25⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        24⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        23⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        22⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        21⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        20⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        19⤵
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        18⤵
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        17⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        16⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        15⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        14⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        13⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        12⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        11⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        10⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        9⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        8⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        7⤵
        
        PID:4872
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        6⤵
        
        PID:1932
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        5⤵
        
        PID:4480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
      4⤵
      PID:2984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
    3⤵
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  PID:5056

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7344 -ip 7344
1⤵
PID:7776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10852 -ip 10852
1⤵
PID:11068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 10972 -ip 10972
1⤵
PID:11192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 11104 -ip 11104
1⤵
PID:10320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 11224 -ip 11224
1⤵
PID:10464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4456 -ip 4456
1⤵
PID:10432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 10308 -ip 10308
1⤵
PID:10836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 10748 -ip 10748
1⤵
PID:11088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 10728 -ip 10728
1⤵
PID:9220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 11140 -ip 11140
1⤵
PID:9760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9960 -ip 9960
1⤵
PID:10732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 10616 -ip 10616
1⤵
PID:564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 10832 -ip 10832
1⤵
PID:10364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 10368 -ip 10368
1⤵
PID:11072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 10936 -ip 10936
1⤵
PID:9816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 11088 -ip 11088
1⤵
PID:10324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10920 -ip 10920
1⤵
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 10704 -ip 10704
1⤵
PID:10112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 10484 -ip 10484
1⤵
PID:11332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 9492 -ip 9492
1⤵
PID:11472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 11388 -ip 11388
1⤵
PID:11604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 11528 -ip 11528
1⤵
PID:11736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 11664 -ip 11664
1⤵
PID:11868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 11788 -ip 11788
1⤵
PID:12000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 11912 -ip 11912
1⤵
PID:12128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 12032 -ip 12032
1⤵
PID:12260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 12172 -ip 12172
1⤵
PID:11420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 11128 -ip 11128
1⤵
PID:11564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 10304 -ip 10304
1⤵
PID:11828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 11692 -ip 11692
1⤵
PID:11780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 11656 -ip 11656
1⤵
PID:12204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 12052 -ip 12052
1⤵
PID:11292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 12144 -ip 12144
1⤵
PID:11372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 11488 -ip 11488
1⤵
PID:11952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 11744 -ip 11744
1⤵
PID:12220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 11904 -ip 11904
1⤵
PID:10692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 11396 -ip 11396
1⤵
PID:11940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 11660 -ip 11660
1⤵
PID:11608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 11640 -ip 11640
1⤵
PID:12220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 10380 -ip 10380
1⤵
PID:12012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 11636 -ip 11636
1⤵
PID:11508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 11552 -ip 11552
1⤵
PID:12380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 11648 -ip 11648
1⤵
PID:12520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 12444 -ip 12444
1⤵
PID:12652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 12564 -ip 12564
1⤵
PID:12792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 12712 -ip 12712
1⤵
PID:12920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 12828 -ip 12828
1⤵
PID:13060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 12952 -ip 12952
1⤵
PID:13184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 13104 -ip 13104
1⤵
PID:12012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 13232 -ip 13232
1⤵
PID:12456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 12304 -ip 12304
1⤵
PID:12612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 12336 -ip 12336
1⤵
PID:12704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 12728 -ip 12728
1⤵
PID:13076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 12880 -ip 12880
1⤵
PID:13256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 13136 -ip 13136
1⤵
PID:12456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 13276 -ip 13276
1⤵
PID:12820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 12412 -ip 12412
1⤵
PID:13060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 12688 -ip 12688
1⤵
PID:13228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 13148 -ip 13148
1⤵
PID:12804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 13924 -ip 13924
1⤵
PID:14820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 15024 -ip 15024
1⤵
PID:15172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 15020 -ip 15020
1⤵
PID:14868

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 14640 -ip 14640
1⤵
PID:14480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$336699.bat

Filesize
259B

MD5
bbe1ecb7e4321cf0d5349dc9d5fd2c80

SHA1
e4dbd582a80477bd65ac4954f6c2964e07e7f45f

SHA256
1215212bdf31b815684dec9d5c3e3c97d4c95799e043f9748e20a0c75c0f5b23

SHA512
dc6e5188960542554c28780aef6e24b21716081aafd4d1b81ebee91b78a325704957cfba348ee94d05c448fd65306bca7791f2545acbdcdf14907a65382b3fcc

Download Submit
C:\Windows\SysWOW64\$$336699.bat

Filesize
141B

MD5
e3efc16ca26ae31f9885ee9549ff1f82

SHA1
4321f47a61712ffbbad7a39691359474db4b947c

SHA256
a03f261cc17b929ef96c2faeef03b77af3b62ab84bbb73a79beb84878b1bfa61

SHA512
f376e9be088782e394d21958bcdb5e7f00605b05290eff1320d64d5a76bfa619c260c8b5d971e7015bb118f0dd13ad73033f76e55b717611bc1a7d876f8e62ab

Download Submit
C:\Windows\SysWOW64\EXPL0RER.EXE

Filesize
62KB

MD5
069930e312b516a91e6b157af6696972

SHA1
a4f2954a404c1362fbe48c2b685b9fabfb6ebf9c

SHA256
99fa5ff5b44e87d2af5645a573e2786f58d76065d25a1530e7c7a0ff72d858a4

SHA512
b833b0cbf5785f2cd550013ca20f10eb30df37b335ea71f7a7ced5a701bd2439e8635f79baf19fb82650b1a0ec7a7690866246b3c4287ffbe0e0b4e1939a3957

Download Submit
memory/116-306-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/224-279-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/832-104-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1368-369-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1520-92-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1876-164-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2028-270-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2360-43-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2676-288-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2716-342-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2820-360-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2884-248-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3100-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3140-594-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3340-351-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3368-152-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3420-80-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3424-468-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3424-20-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3428-200-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3596-128-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3620-260-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3944-315-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3972-297-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3972-387-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3976-56-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4164-116-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4264-333-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4340-549-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4440-31-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4508-188-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4532-68-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4776-212-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4784-224-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5000-236-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5064-324-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5064-378-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5064-176-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5132-576-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5172-396-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5260-513-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5312-405-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5440-414-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5460-531-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5460-477-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5532-486-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5580-423-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5584-567-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5648-558-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5648-585-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5716-432-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5768-522-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5816-495-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5832-540-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5852-441-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5976-450-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6072-504-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6140-459-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6196-603-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6328-612-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6472-621-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6600-630-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6744-639-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6872-648-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download