c6260cf7a6f2c3b278b1899cfdc5d82d880b8a4c1d05b8798fc18ac24858126f

Analysis

max time kernel
6s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260714_41d02d.bat
Size 21KB
Sample260714-pre97afv7x
SHA256 c6260cf7a6f2c3b278b1899cfdc5d82d880b8a4c1d05b8798fc18ac24858126f
MD5 1dd0042e69bac01842b14405edb2e606
SHA1 d1f82b372be560a6815e700acc5bf09abb9167ad
SHA512 a287f9cce450e88cca00a4023e8eb98643faf0ef3fb33d97859f298167add07116c0ea5699dd6ed6ac29e51bbaa9a22ccbf0db55ce2ef73acf6a1fc6b72cecf1
SSDEEP 384:eaNHcmSaHE+aKesMOTXbwU0dHRLLGDIfFA:Te4v
TLSH
T1C0A2BB326440B7750768EC1598B1FC2EA75914E6D2322A40F0DE4DEA6F72DB4FD18EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1872	1504	cmd.exe	85
PID 1504 wrote to memory of 1296	1504	cmd.exe	86
PID 1504 wrote to memory of 2720	1504	cmd.exe	87
PID 1296 wrote to memory of 2500	1296	cmd.exe	88
PID 1296 wrote to memory of 4172	1296	cmd.exe	89
PID 2720 wrote to memory of 920	2720	cmd.exe	90
PID 2720 wrote to memory of 4720	2720	cmd.exe	91
PID 920 wrote to memory of 3452	920	cmd.exe	92
PID 920 wrote to memory of 2392	920	cmd.exe	93
PID 4172 wrote to memory of 4616	4172	cmd.exe	94
PID 4172 wrote to memory of 4276	4172	cmd.exe	95
PID 2500 wrote to memory of 2120	2500	cmd.exe	96
PID 2500 wrote to memory of 2496	2500	cmd.exe	97
PID 4720 wrote to memory of 536	4720	cmd.exe	98
PID 4720 wrote to memory of 4380	4720	cmd.exe	99
PID 4616 wrote to memory of 1216	4616	cmd.exe	100
PID 4616 wrote to memory of 3608	4616	cmd.exe	101
PID 2392 wrote to memory of 3356	2392	cmd.exe	102
PID 2392 wrote to memory of 2916	2392	cmd.exe	103
PID 4276 wrote to memory of 4776	4276	cmd.exe	104
PID 4276 wrote to memory of 1748	4276	cmd.exe	105
PID 3452 wrote to memory of 2204	3452	cmd.exe	106
PID 3452 wrote to memory of 2264	3452	cmd.exe	107
PID 2120 wrote to memory of 388	2120	cmd.exe	108
PID 2120 wrote to memory of 3376	2120	cmd.exe	109
PID 536 wrote to memory of 5036	536	cmd.exe	110
PID 536 wrote to memory of 2968	536	cmd.exe	111
PID 2496 wrote to memory of 2484	2496	cmd.exe	112
PID 2496 wrote to memory of 3664	2496	cmd.exe	113
PID 4380 wrote to memory of 5024	4380	cmd.exe	114
PID 3608 wrote to memory of 4444	3608	cmd.exe	115
PID 3608 wrote to memory of 1660	3608	cmd.exe	116
PID 4380 wrote to memory of 4268	4380	cmd.exe	117
PID 4776 wrote to memory of 4232	4776	cmd.exe	118
PID 4776 wrote to memory of 220	4776	cmd.exe	119
PID 2264 wrote to memory of 3300	2264	cmd.exe	120
PID 2264 wrote to memory of 3184	2264	cmd.exe	121
PID 1216 wrote to memory of 468	1216	cmd.exe	122
PID 1216 wrote to memory of 3296	1216	cmd.exe	123
PID 2916 wrote to memory of 3908	2916	cmd.exe	124
PID 2916 wrote to memory of 4024	2916	cmd.exe	125
PID 3356 wrote to memory of 2704	3356	cmd.exe	126
PID 3356 wrote to memory of 4596	3356	cmd.exe	127
PID 3376 wrote to memory of 3896	3376	cmd.exe	128
PID 3376 wrote to memory of 3808	3376	cmd.exe	129
PID 2204 wrote to memory of 5068	2204	cmd.exe	130
PID 2204 wrote to memory of 3380	2204	cmd.exe	131
PID 3664 wrote to memory of 4944	3664	cmd.exe	132
PID 3664 wrote to memory of 5076	3664	cmd.exe	133
PID 2968 wrote to memory of 748	2968	cmd.exe	134
PID 2968 wrote to memory of 1668	2968	cmd.exe	135
PID 1660 wrote to memory of 988	1660	cmd.exe	136
PID 1660 wrote to memory of 448	1660	cmd.exe	137
PID 2484 wrote to memory of 1516	2484	cmd.exe	138
PID 2484 wrote to memory of 3924	2484	cmd.exe	139
PID 388 wrote to memory of 2360	388	cmd.exe	140
PID 388 wrote to memory of 2736	388	cmd.exe	141
PID 1748 wrote to memory of 2268	1748	cmd.exe	142
PID 1748 wrote to memory of 688	1748	cmd.exe	143
PID 5036 wrote to memory of 5108	5036	cmd.exe	144
PID 5036 wrote to memory of 2432	5036	cmd.exe	145
PID 4444 wrote to memory of 4192	4444	cmd.exe	146
PID 4444 wrote to memory of 2232	4444	cmd.exe	147
PID 3808 wrote to memory of 2452	3808	cmd.exe	148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:388
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:2360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:9984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:2208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:2736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:4884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:4780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3376
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:3896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:2804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:2992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:9324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:2452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:3308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:9292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:1516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:1760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:9700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:4504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:9608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:3924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:4768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:1052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:1416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:9532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:4944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:5096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:3804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:3912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12668
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:5076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:5004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:12064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1216
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14296
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:3296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:3836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:2644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3608
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:4192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:2488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:2232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11904
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:4248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:6712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:11484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:6724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:11916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:11688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:1076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:12984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:4288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:6808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:6816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:13812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:10932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:4636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:6328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:9788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:10176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:10784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:9796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:11712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:11720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:6336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:3848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:6280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:9244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:9260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:6288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:9876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:8452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:9476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:9912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:10208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:10056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4776
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:3984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:3492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:2268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:4860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:7284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:7296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11112
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:8780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:2996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:5068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:4092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:8284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:3420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:8920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:8904
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:3380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:3840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:4820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2264
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:3300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:2936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:4932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12552
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:3184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3356
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:2704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:3952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:4596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:2380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:2344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:5088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:3908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:2684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:4312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:4656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:4272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:4024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:7948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:4704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:5196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:7372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:15080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:14320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:7380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:5132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:7064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:12048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:7072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:5140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:9456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:2432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:1612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:7144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:7152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:12076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:1204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:7104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:7112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:12012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:4320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:8580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:11604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:10884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:2656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:10012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:15212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:15220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:10020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:15336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        11⤵
        
        PID:13508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        11⤵
        
        PID:13516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:12888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13180
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:1668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:3312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:9460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:9468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:2444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:6012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:13784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:14420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:14692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:6020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:8644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:12984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:13044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:10832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:8652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        10⤵
        
        PID:15156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        10⤵
        
        PID:11580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        
        PID:5024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:3656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:5164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:7012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:7020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:5172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:12084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:7180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11344
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:1744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:5452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:7840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:11824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:11996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:7848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:13752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:13860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:5460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:8384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:12576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:12584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:8392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:13244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:13320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        
        PID:4268
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:5612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:8336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:13596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:13620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:8348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:12628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:12692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:12628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:5628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:9428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:14428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        9⤵
        
        PID:14684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:9436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        9⤵
        
        PID:14668
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:3696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        7⤵
        
        PID:6424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:10596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:10604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        7⤵
        
        PID:6616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        8⤵
        
        PID:11688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        8⤵
        
        PID:11732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/10132-1-0x00007FF6C9D30000-0x00007FF6C9D97000-memory.dmp

Download

memory/11408-2-0x00007FF6C9D30000-0x00007FF6C9D97000-memory.dmp

Download

memory/12896-0-0x00007FF6C9D30000-0x00007FF6C9D97000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads