d32ff030e75486237946205a8df7392303ea316b8791d3c38ee93613322bfb0e

Analysis

user interaction
yes
max time kernel
600s
max time network
455s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crahser.bat
Size 46KB
Sample260623-j5devsbw9s
SHA256 d32ff030e75486237946205a8df7392303ea316b8791d3c38ee93613322bfb0e
MD5 c52713bdfbff762f7d99e927aeecd70e
SHA1 e56f3875c1154a90e6d1a22431cda6336384c014
SHA512 14d0bde1f68ebd6b88e1e2ae878d6deb6dc8f22d60f0fea4ee609ccd6761926c989066c63a11844ecffa1e0f4a7c6f8bebf17c35cc792b5662b565d9a38c8982
SSDEEP 768:bz3333333333333333333333333333333333333333333333333333333333333d:bx
TLSH
T1D9231BDEF8AE9C66992FE15106FA5CEDE551018AB042CFFCF69219557D003F849CC41A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
912	cscript.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1388	explorer.exe
6024	explorer.exe
2220	explorer.exe
6040	explorer.exe
3776	explorer.exe
2672	explorer.exe
5476	explorer.exe
1908	explorer.exe
3056	explorer.exe
5684	explorer.exe
1124	explorer.exe
2588	explorer.exe
3480	explorer.exe
1824	explorer.exe
3896	explorer.exe
6100	explorer.exe
3324	explorer.exe
1636	explorer.exe
4544	explorer.exe
2728	explorer.exe
4848	explorer.exe
4532	explorer.exe
5528	explorer.exe
4636	explorer.exe
3788	explorer.exe
5136	explorer.exe
4368	explorer.exe
6104	explorer.exe
1796	explorer.exe
4768	explorer.exe
4208	explorer.exe
1504	explorer.exe
4724	explorer.exe
4164	explorer.exe
4680	explorer.exe
2024	explorer.exe
4828	explorer.exe
6204	explorer.exe
6300	explorer.exe
6396	explorer.exe
6492	explorer.exe
6588	explorer.exe
6684	explorer.exe
6780	explorer.exe
6876	explorer.exe
6972	explorer.exe
7068	explorer.exe
7164	explorer.exe
6268	explorer.exe
6460	explorer.exe
7016	explorer.exe
7132	explorer.exe
6812	explorer.exe
6584	explorer.exe
7244	explorer.exe
7356	explorer.exe
7460	explorer.exe
7572	explorer.exe
7684	explorer.exe
7808	explorer.exe
7916	explorer.exe
8020	explorer.exe
8136	explorer.exe
7240	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1388	explorer.exe
6024	explorer.exe
2220	explorer.exe
6040	explorer.exe
3776	explorer.exe
2672	explorer.exe
5476	explorer.exe
1908	explorer.exe
3056	explorer.exe
5684	explorer.exe
1124	explorer.exe
2588	explorer.exe
3480	explorer.exe
1824	explorer.exe
3896	explorer.exe
6100	explorer.exe
3324	explorer.exe
1636	explorer.exe
4544	explorer.exe
2728	explorer.exe
4848	explorer.exe
4532	explorer.exe
5528	explorer.exe
4636	explorer.exe
3788	explorer.exe
5136	explorer.exe
4368	explorer.exe
6104	explorer.exe
1796	explorer.exe
4768	explorer.exe
4208	explorer.exe
1504	explorer.exe
4724	explorer.exe
4164	explorer.exe
4680	explorer.exe
2024	explorer.exe
4828	explorer.exe
6204	explorer.exe
6300	explorer.exe
6396	explorer.exe
6492	explorer.exe
6588	explorer.exe
6684	explorer.exe
6780	explorer.exe
6876	explorer.exe
6972	explorer.exe
7068	explorer.exe
7164	explorer.exe
6268	explorer.exe
6460	explorer.exe
7016	explorer.exe
7132	explorer.exe
6812	explorer.exe
6584	explorer.exe
7244	explorer.exe
7356	explorer.exe
7460	explorer.exe
7572	explorer.exe
7684	explorer.exe
7808	explorer.exe
7916	explorer.exe
8020	explorer.exe
8136	explorer.exe
7240	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 912	4276	cmd.exe	89
PID 912 wrote to memory of 2564	912	cscript.exe	90
PID 912 wrote to memory of 1280	912	cscript.exe	92
PID 912 wrote to memory of 3956	912	cscript.exe	95
PID 912 wrote to memory of 1528	912	cscript.exe	98
PID 4760 wrote to memory of 5800	4760	cmd.exe	99
PID 5800 wrote to memory of 4468	5800	cmd.exe	101
PID 912 wrote to memory of 5952	912	cscript.exe	102
PID 4468 wrote to memory of 2560	4468	cmd.exe	104
PID 912 wrote to memory of 3604	912	cscript.exe	161
PID 912 wrote to memory of 5796	912	cscript.exe	108
PID 5600 wrote to memory of 5804	5600	cmd.exe	111
PID 912 wrote to memory of 6072	912	cscript.exe	164
PID 912 wrote to memory of 2892	912	cscript.exe	114
PID 5804 wrote to memory of 1940	5804	cmd.exe	115
PID 912 wrote to memory of 4060	912	cscript.exe	117
PID 1940 wrote to memory of 1512	1940	cmd.exe	118
PID 1512 wrote to memory of 2748	1512	cmd.exe	120
PID 912 wrote to memory of 2344	912	cscript.exe	121
PID 2748 wrote to memory of 3628	2748	cmd.exe	123
PID 912 wrote to memory of 5576	912	cscript.exe	124
PID 3628 wrote to memory of 4688	3628	cmd.exe	126
PID 912 wrote to memory of 5036	912	cscript.exe	171
PID 4688 wrote to memory of 5848	4688	cmd.exe	129
PID 912 wrote to memory of 2684	912	cscript.exe	130
PID 912 wrote to memory of 2932	912	cscript.exe	132
PID 5848 wrote to memory of 3756	5848	cmd.exe	133
PID 3756 wrote to memory of 1252	3756	cmd.exe	136
PID 912 wrote to memory of 4936	912	cscript.exe	191
PID 912 wrote to memory of 2396	912	cscript.exe	140
PID 1252 wrote to memory of 3288	1252	cmd.exe	141
PID 912 wrote to memory of 6056	912	cscript.exe	143
PID 3288 wrote to memory of 1604	3288	cmd.exe	144
PID 1604 wrote to memory of 2916	1604	cmd.exe	146
PID 912 wrote to memory of 1052	912	cscript.exe	147
PID 2916 wrote to memory of 3204	2916	cmd.exe	149
PID 912 wrote to memory of 3184	912	cscript.exe	150
PID 3204 wrote to memory of 4432	3204	cmd.exe	152
PID 912 wrote to memory of 2116	912	cscript.exe	153
PID 4432 wrote to memory of 1620	4432	cmd.exe	155
PID 912 wrote to memory of 4208	912	cscript.exe	184
PID 1620 wrote to memory of 2724	1620	cmd.exe	158
PID 912 wrote to memory of 1680	912	cscript.exe	159
PID 2724 wrote to memory of 3604	2724	cmd.exe	161
PID 912 wrote to memory of 3380	912	cscript.exe	162
PID 912 wrote to memory of 6072	912	cscript.exe	164
PID 3604 wrote to memory of 4944	3604	cmd.exe	165
PID 4944 wrote to memory of 5588	4944	cmd.exe	167
PID 912 wrote to memory of 4952	912	cscript.exe	168
PID 5588 wrote to memory of 6000	5588	cmd.exe	170
PID 912 wrote to memory of 5036	912	cscript.exe	171
PID 6000 wrote to memory of 1292	6000	cmd.exe	173
PID 912 wrote to memory of 552	912	cscript.exe	192
PID 1292 wrote to memory of 5224	1292	cmd.exe	176
PID 912 wrote to memory of 3396	912	cscript.exe	177
PID 5224 wrote to memory of 1956	5224	cmd.exe	179
PID 912 wrote to memory of 2348	912	cscript.exe	180
PID 1956 wrote to memory of 5372	1956	cmd.exe	182
PID 912 wrote to memory of 3732	912	cscript.exe	183
PID 5372 wrote to memory of 5524	5372	cmd.exe	185
PID 912 wrote to memory of 3496	912	cscript.exe	421
PID 5524 wrote to memory of 5232	5524	cmd.exe	188
PID 912 wrote to memory of 2024	912	cscript.exe	199
PID 912 wrote to memory of 4936	912	cscript.exe	191

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\crahser.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\run_cmd_through_run.vbs"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2564
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1280
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3956
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1528
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5952
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3604
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5796
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6072
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2892
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4060
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2344
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5576
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5036
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2684
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2932
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4936
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2396
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6056
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1052
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3184
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2116
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4208
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1680
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3380
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6072
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4952
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5036
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:552
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3396
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2348
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3732
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3496
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2024
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4936
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5616
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3496
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6068
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6168
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6264
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6360
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6460
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6556
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6640
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6736
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6832
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6936
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7032
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7128
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6200
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6372
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6828
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7064
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6388
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7044
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7196
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7320
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7420
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7536
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7648
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7776
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7884
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7988
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8100
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7104
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7512
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4504
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7896
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8132
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7512
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7896
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7672
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8224
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8340
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8444
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8540
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8648
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8748
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8836
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8932
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9044
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9132
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7540
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8340
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8556
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8924
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9060
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8344
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8556
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9044
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:724
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9288
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9480
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9576
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9672
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9760
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9868
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9960
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10060
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10144
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2732
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9408
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9656
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9792
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9968
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10176
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9456
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9780
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4908
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9792
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10268
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10360
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10464
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10552
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10652
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10760
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10856
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10940
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:11052
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:11148
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:11248
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10448
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10584
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10768
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10976
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:11232
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:11252
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4156
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:11040
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10252
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5612
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3792
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:11016
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4932
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7880
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7324
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7448
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1320
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1124
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2588
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3900
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5592
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:8808
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10980
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3324
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:9152
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5632
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5904
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1332
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2460
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2668
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1948
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2368
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3528
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1276
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1424
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6044
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:3188
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:2668
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4268
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1532
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5692
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6272
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6404
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:5440
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:4916
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6312
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6784
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6600
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:10180
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:7136
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:6992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6024

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      PID:2560

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Windows\system32\cmd.exe
        
        cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\system32\cmd.exe
        
        cmd
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\system32\cmd.exe
        
        cmd
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5848
        
        C:\Windows\system32\cmd.exe
        
        cmd
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\system32\cmd.exe
        
        cmd
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\system32\cmd.exe
        
        cmd
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\system32\cmd.exe
        
        cmd
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\system32\cmd.exe
        
        cmd
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\system32\cmd.exe
        
        cmd
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\system32\cmd.exe
        
        cmd
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\system32\cmd.exe
        
        cmd
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        cmd
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        cmd
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\system32\cmd.exe
        
        cmd
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\system32\cmd.exe
        
        cmd
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Windows\system32\cmd.exe
        
        cmd
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\system32\cmd.exe
        
        cmd
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\system32\cmd.exe
        
        cmd
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Windows\system32\cmd.exe
        
        cmd
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        cmd
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:5372
        
        C:\Windows\system32\cmd.exe
        
        cmd
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Windows\system32\cmd.exe
        
        cmd
        27⤵
        
        PID:5232
        
        C:\Windows\system32\cmd.exe
        
        cmd
        28⤵
        
        PID:552
        
        C:\Windows\system32\cmd.exe
        
        cmd
        29⤵
        
        PID:300
        
        C:\Windows\system32\cmd.exe
        
        cmd
        30⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        cmd
        31⤵
        
        PID:5536
        
        C:\Windows\system32\cmd.exe
        
        cmd
        32⤵
        
        PID:6160
        
        C:\Windows\system32\cmd.exe
        
        cmd
        33⤵
        
        PID:6256
        
        C:\Windows\system32\cmd.exe
        
        cmd
        34⤵
        
        PID:6352
        
        C:\Windows\system32\cmd.exe
        
        cmd
        35⤵
        
        PID:6448
        
        C:\Windows\system32\cmd.exe
        
        cmd
        36⤵
        
        PID:6544
        
        C:\Windows\system32\cmd.exe
        
        cmd
        37⤵
        
        PID:6648
        
        C:\Windows\system32\cmd.exe
        
        cmd
        38⤵
        
        PID:6752
        
        C:\Windows\system32\cmd.exe
        
        cmd
        39⤵
        
        PID:6840
        
        C:\Windows\system32\cmd.exe
        
        cmd
        40⤵
        
        PID:6928
        
        C:\Windows\system32\cmd.exe
        
        cmd
        41⤵
        
        PID:7024
        
        C:\Windows\system32\cmd.exe
        
        cmd
        42⤵
        
        PID:7120
        
        C:\Windows\system32\cmd.exe
        
        cmd
        43⤵
        
        PID:6184
        
        C:\Windows\system32\cmd.exe
        
        cmd
        44⤵
        
        PID:6428
        
        C:\Windows\system32\cmd.exe
        
        cmd
        45⤵
        
        PID:6864
        
        C:\Windows\system32\cmd.exe
        
        cmd
        46⤵
        
        PID:7036
        
        C:\Windows\system32\cmd.exe
        
        cmd
        47⤵
        
        PID:6200
        
        C:\Windows\system32\cmd.exe
        
        cmd
        48⤵
        
        PID:6248
        
        C:\Windows\system32\cmd.exe
        
        cmd
        49⤵
        
        PID:7204
        
        C:\Windows\system32\cmd.exe
        
        cmd
        50⤵
        
        PID:7312
        
        C:\Windows\system32\cmd.exe
        
        cmd
        51⤵
        
        PID:7412
        
        C:\Windows\system32\cmd.exe
        
        cmd
        52⤵
        
        PID:7524
        
        C:\Windows\system32\cmd.exe
        
        cmd
        53⤵
        
        PID:7640
        
        C:\Windows\system32\cmd.exe
        
        cmd
        54⤵
        
        PID:7764
        
        C:\Windows\system32\cmd.exe
        
        cmd
        55⤵
        
        PID:7872
        
        C:\Windows\system32\cmd.exe
        
        cmd
        56⤵
        
        PID:7976
        
        C:\Windows\system32\cmd.exe
        
        cmd
        57⤵
        
        PID:8092
        
        C:\Windows\system32\cmd.exe
        
        cmd
        58⤵
        
        PID:7152
        
        C:\Windows\system32\cmd.exe
        
        cmd
        59⤵
        
        PID:2944
        
        C:\Windows\system32\cmd.exe
        
        cmd
        60⤵
        
        PID:7612
        
        C:\Windows\system32\cmd.exe
        
        cmd
        61⤵
        
        PID:7868
        
        C:\Windows\system32\cmd.exe
        
        cmd
        62⤵
        
        PID:8116
        
        C:\Windows\system32\cmd.exe
        
        cmd
        63⤵
        
        PID:7452
        
        C:\Windows\system32\cmd.exe
        
        cmd
        64⤵
        
        PID:7972
        
        C:\Windows\system32\cmd.exe
        
        cmd
        65⤵
        
        PID:1892
        
        C:\Windows\system32\cmd.exe
        
        cmd
        66⤵
        
        PID:8216
        
        C:\Windows\system32\cmd.exe
        
        cmd
        67⤵
        
        PID:8328
        
        C:\Windows\system32\cmd.exe
        
        cmd
        68⤵
        
        PID:8432
        
        C:\Windows\system32\cmd.exe
        
        cmd
        69⤵
        
        PID:8548
        
        C:\Windows\system32\cmd.exe
        
        cmd
        70⤵
        
        PID:8640
        
        C:\Windows\system32\cmd.exe
        
        cmd
        71⤵
        
        PID:8736
        
        C:\Windows\system32\cmd.exe
        
        cmd
        72⤵
        
        PID:8844
        
        C:\Windows\system32\cmd.exe
        
        cmd
        73⤵
        
        PID:8940
        
        C:\Windows\system32\cmd.exe
        
        cmd
        74⤵
        
        PID:9032
        
        C:\Windows\system32\cmd.exe
        
        cmd
        75⤵
        
        PID:9140
        
        C:\Windows\system32\cmd.exe
        
        cmd
        76⤵
        
        PID:8088
        
        C:\Windows\system32\cmd.exe
        
        cmd
        77⤵
        
        PID:8368
        
        C:\Windows\system32\cmd.exe
        
        cmd
        78⤵
        
        PID:8620
        
        C:\Windows\system32\cmd.exe
        
        cmd
        79⤵
        
        PID:8812
        
        C:\Windows\system32\cmd.exe
        
        cmd
        80⤵
        
        PID:9028
        
        C:\Windows\system32\cmd.exe
        
        cmd
        81⤵
        
        PID:8228
        
        C:\Windows\system32\cmd.exe
        
        cmd
        82⤵
        
        PID:8652

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1292

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4724

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6396

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6492

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6268

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6460

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7132

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7244

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7356

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7460

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:8020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:8136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:7240

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:7424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:7736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:5320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7748

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:8260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:8876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9076

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9176

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:8468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:8676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8836

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8248

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:9208
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:9260
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9376
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      PID:9472
    - - C:\Windows\system32\cmd.exe
        
        cmd
        5⤵
        
        PID:9568
      - C:\Windows\system32\cmd.exe
        
        cmd
        6⤵
        
        PID:9664
        
        C:\Windows\system32\cmd.exe
        
        cmd
        7⤵
        
        PID:9768
        
        C:\Windows\system32\cmd.exe
        
        cmd
        8⤵
        
        PID:9856
        
        C:\Windows\system32\cmd.exe
        
        cmd
        9⤵
        
        PID:9952
        
        C:\Windows\system32\cmd.exe
        
        cmd
        10⤵
        
        PID:10048
        
        C:\Windows\system32\cmd.exe
        
        cmd
        11⤵
        
        PID:10160
        
        C:\Windows\system32\cmd.exe
        
        cmd
        12⤵
        
        PID:9256
        
        C:\Windows\system32\cmd.exe
        
        cmd
        13⤵
        
        PID:9356
        
        C:\Windows\system32\cmd.exe
        
        cmd
        14⤵
        
        PID:9592
        
        C:\Windows\system32\cmd.exe
        
        cmd
        15⤵
        
        PID:9764
        
        C:\Windows\system32\cmd.exe
        
        cmd
        16⤵
        
        PID:9980
        
        C:\Windows\system32\cmd.exe
        
        cmd
        17⤵
        
        PID:10156
        
        C:\Windows\system32\cmd.exe
        
        cmd
        18⤵
        
        PID:9396
        
        C:\Windows\system32\cmd.exe
        
        cmd
        19⤵
        
        PID:9800
        
        C:\Windows\system32\cmd.exe
        
        cmd
        20⤵
        
        PID:10144
        
        C:\Windows\system32\cmd.exe
        
        cmd
        21⤵
        
        PID:10232
        
        C:\Windows\system32\cmd.exe
        
        cmd
        22⤵
        
        PID:10260
        
        C:\Windows\system32\cmd.exe
        
        cmd
        23⤵
        
        PID:10368
        
        C:\Windows\system32\cmd.exe
        
        cmd
        24⤵
        
        PID:10456
        
        C:\Windows\system32\cmd.exe
        
        cmd
        25⤵
        
        PID:10564
        
        C:\Windows\system32\cmd.exe
        
        cmd
        26⤵
        
        PID:10660
        
        C:\Windows\system32\cmd.exe
        
        cmd
        27⤵
        
        PID:10748
        
        C:\Windows\system32\cmd.exe
        
        cmd
        28⤵
        
        PID:10844
        
        C:\Windows\system32\cmd.exe
        
        cmd
        29⤵
        
        PID:10948
        
        C:\Windows\system32\cmd.exe
        
        cmd
        30⤵
        
        PID:11044
        
        C:\Windows\system32\cmd.exe
        
        cmd
        31⤵
        
        PID:11140
        
        C:\Windows\system32\cmd.exe
        
        cmd
        32⤵
        
        PID:11240
        
        C:\Windows\system32\cmd.exe
        
        cmd
        33⤵
        
        PID:10384
        
        C:\Windows\system32\cmd.exe
        
        cmd
        34⤵
        
        PID:10572
        
        C:\Windows\system32\cmd.exe
        
        cmd
        35⤵
        
        PID:5756
        
        C:\Windows\system32\cmd.exe
        
        cmd
        36⤵
        
        PID:10964
        
        C:\Windows\system32\cmd.exe
        
        cmd
        37⤵
        
        PID:11152
        
        C:\Windows\system32\cmd.exe
        
        cmd
        38⤵
        
        PID:6760
        
        C:\Windows\system32\cmd.exe
        
        cmd
        39⤵
        
        PID:6924
        
        C:\Windows\system32\cmd.exe
        
        cmd
        40⤵
        
        PID:3608
        
        C:\Windows\system32\cmd.exe
        
        cmd
        41⤵
        
        PID:11168
        
        C:\Windows\system32\cmd.exe
        
        cmd
        42⤵
        
        PID:10292
        
        C:\Windows\system32\cmd.exe
        
        cmd
        43⤵
        
        PID:7388
        
        C:\Windows\system32\cmd.exe
        
        cmd
        44⤵
        
        PID:1240
        
        C:\Windows\system32\cmd.exe
        
        cmd
        45⤵
        
        PID:1848
        
        C:\Windows\system32\cmd.exe
        
        cmd
        46⤵
        
        PID:5308
        
        C:\Windows\system32\cmd.exe
        
        cmd
        47⤵
        
        PID:2008
        
        C:\Windows\system32\cmd.exe
        
        cmd
        48⤵
        
        PID:7488
        
        C:\Windows\system32\cmd.exe
        
        cmd
        49⤵
        
        PID:5020
        
        C:\Windows\system32\cmd.exe
        
        cmd
        50⤵
        
        PID:8176
        
        C:\Windows\system32\cmd.exe
        
        cmd
        51⤵
        
        PID:3924
        
        C:\Windows\system32\cmd.exe
        
        cmd
        52⤵
        
        PID:1204
        
        C:\Windows\system32\cmd.exe
        
        cmd
        53⤵
        
        PID:5064
        
        C:\Windows\system32\cmd.exe
        
        cmd
        54⤵
        
        PID:7708
        
        C:\Windows\system32\cmd.exe
        
        cmd
        55⤵
        
        PID:2588
        
        C:\Windows\system32\cmd.exe
        
        cmd
        56⤵
        
        PID:2520
        
        C:\Windows\system32\cmd.exe
        
        cmd
        57⤵
        
        PID:5752
        
        C:\Windows\system32\cmd.exe
        
        cmd
        58⤵
        
        PID:2820
        
        C:\Windows\system32\cmd.exe
        
        cmd
        59⤵
        
        PID:8580
        
        C:\Windows\system32\cmd.exe
        
        cmd
        60⤵
        
        PID:4628
        
        C:\Windows\system32\cmd.exe
        
        cmd
        61⤵
        
        PID:768
        
        C:\Windows\system32\cmd.exe
        
        cmd
        62⤵
        
        PID:4636
        
        C:\Windows\system32\cmd.exe
        
        cmd
        63⤵
        
        PID:5924
        
        C:\Windows\system32\cmd.exe
        
        cmd
        64⤵
        
        PID:5648
        
        C:\Windows\system32\cmd.exe
        
        cmd
        65⤵
        
        PID:9544
        
        C:\Windows\system32\cmd.exe
        
        cmd
        66⤵
        
        PID:1928
        
        C:\Windows\system32\cmd.exe
        
        cmd
        67⤵
        
        PID:2020
        
        C:\Windows\system32\cmd.exe
        
        cmd
        68⤵
        
        PID:4476
        
        C:\Windows\system32\cmd.exe
        
        cmd
        69⤵
        
        PID:5796
        
        C:\Windows\system32\cmd.exe
        
        cmd
        70⤵
        
        PID:5632
        
        C:\Windows\system32\cmd.exe
        
        cmd
        71⤵
        
        PID:9740
        
        C:\Windows\system32\cmd.exe
        
        cmd
        72⤵
        
        PID:6108
        
        C:\Windows\system32\cmd.exe
        
        cmd
        73⤵
        
        PID:6188
        
        C:\Windows\system32\cmd.exe
        
        cmd
        74⤵
        
        PID:5520
        
        C:\Windows\system32\cmd.exe
        
        cmd
        75⤵
        
        PID:4376
        
        C:\Windows\system32\cmd.exe
        
        cmd
        76⤵
        
        PID:6456
        
        C:\Windows\system32\cmd.exe
        
        cmd
        77⤵
        
        PID:3528
        
        C:\Windows\system32\cmd.exe
        
        cmd
        78⤵
        
        PID:6704
        
        C:\Windows\system32\cmd.exe
        
        cmd
        79⤵
        
        PID:3372
        
        C:\Windows\system32\cmd.exe
        
        cmd
        80⤵
        
        PID:6900
        
        C:\Windows\system32\cmd.exe
        
        cmd
        81⤵
        
        PID:7052
        
        C:\Windows\system32\cmd.exe
        
        cmd
        82⤵
        
        PID:2956
        
        C:\Windows\system32\cmd.exe
        
        cmd
        83⤵
        
        PID:6296
        
        C:\Windows\system32\cmd.exe
        
        cmd
        84⤵
        
        PID:10476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9420

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9516

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9804

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:10184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9944

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:10596

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:10792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10984

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:11088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11180

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:5292

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:11236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:6580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1304

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:2688

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5212

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:1876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:824

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:1320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2004

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:8728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:1968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:5920

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4848

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3180

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:5760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10120

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:9776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:6592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:8336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4940

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:8820

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:8892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:8472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

run_cmd_through_run.vbs

Path C:\Users\Admin\AppData\Local\Temp\run_cmd_through_run.vbs
Size 4KB
SHA256 65f7183c2f46c4b3b96885ce595c12d9221ab04edd5d4f2b2eb6a8fd9a5dd0cf
MD5 271f982a80f638b7b39bd7a38ec1ed7c
SHA1 445d0180dad6433f4209f958394ead46b7437c76
SHA512 439539a7fc4e4df71031d293be7020e2d41869ffac3b4fc040221b229d0ff892cd8695c1d5cbf1fcbcc3a6487b651752bfa21224f55fed4698ab9d0242a31886
SSDEEP 96:/IqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqIqI1:/ffffffffffffffffffffffffE
TLSH
T1FC91136CDCEFD8E9654EF1B34E7796F596CE1512B4474D34B31485096611040CF25D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run_cmd_through_run.vbs

Path C:\Users\Admin\AppData\Local\Temp\run_cmd_through_run.vbs
Size 2KB
SHA256 810cbf16094b4c37851265bf2bb4455838c059c057d78f9dddb1eac24fabf9f3
MD5 6ec507520cd20d4c83c7570e22b0c26a
SHA1 d950a0d89f2b625bb53a84d9eb8111aa38cbd438
SHA512 44060a46291d7196f2bbffe952fae640959f925dbedffcaadabaa203f5d09f815309a2951bb266cfc0217ca0795764d6f39495bc85e4e86bb94e91338f8c72df
TLSH
T15C5123A8CCEED8E9664EF1A34E779AF596CE1512A4474D24A3148509A612040CF25D27
MD5 SHA1 SHA512 TLSH

Submit Download

run_cmd_through_run.vbs

Path C:\Users\Admin\AppData\Local\Temp\run_cmd_through_run.vbs
Size 29KB
SHA256 34d056af4128a0e995ca38735416a3fd0fa0372778ce66694161ecc7e5ca2f30
MD5 9d077b49f899b78fe9f878158eb0ba2b
SHA1 ae86c0e5b7cd8e9835909ae013d4d3387c6ef334
SHA512 220a353b82e01703d5f17e27db5c6f7da1ea52f9c700aff6cd6b383c9827f53bba9aa74c11ade202e79c6779fda2a765b79af97c05668f843acc600ac78f65e9
SSDEEP 768:/ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffr:j
TLSH
T100D2126CDCEEDCE9364EF2B34EB796F996CE1422B4474D34A31486097621080CF21937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads