fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce

Analysis

max time kernel
26s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce.exe
Size 62KB
Sample260924-ml1mtsbd85
SHA256 fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce
MD5 851e607c95df6b80b36f789879262d53
SHA1 ebb1cbcd2efafedf66ad08e161d28d46f567f440
SHA512 44e2b07045e5a70e144b56c6a86b6298ea6040488c25a1b5ee1945abbc75cb44e30c20ef3430abc2f38d3a5e9deab6f93a9a404f9c15857f745f491623bc9acb
SSDEEP 1536:LlqAd1s1p5h8B4/M8pQA80SkvKjRevw3ut:/d1aq5GQA80NvKjRevw3ut
TLSH
T10D536D13B5C08EB2D065CEFC5C1AD2A599277EB11CB4945BB9AD1FCE8D2D2C26D2C243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2980	EXPL0RER.EXE
4984	EXPL0RER.EXE
1384	EXPL0RER.EXE
2204	EXPL0RER.EXE
3588	EXPL0RER.EXE
628	EXPL0RER.EXE
820	EXPL0RER.EXE
2304	EXPL0RER.EXE
4752	EXPL0RER.EXE
3916	EXPL0RER.EXE
2160	EXPL0RER.EXE
2880	EXPL0RER.EXE
3484	EXPL0RER.EXE
4636	EXPL0RER.EXE
4072	EXPL0RER.EXE
4512	EXPL0RER.EXE
368	EXPL0RER.EXE
960	EXPL0RER.EXE
3292	EXPL0RER.EXE
4336	EXPL0RER.EXE
2460	EXPL0RER.EXE
2268	EXPL0RER.EXE
2380	EXPL0RER.EXE
2276	EXPL0RER.EXE
1416	EXPL0RER.EXE
4508	EXPL0RER.EXE
4388	EXPL0RER.EXE
5008	EXPL0RER.EXE
5096	EXPL0RER.EXE
3812	EXPL0RER.EXE
4148	EXPL0RER.EXE
4080	EXPL0RER.EXE
3736	EXPL0RER.EXE
4904	EXPL0RER.EXE
404	EXPL0RER.EXE
1256	EXPL0RER.EXE
2640	EXPL0RER.EXE
3164	EXPL0RER.EXE
2604	EXPL0RER.EXE
4100	EXPL0RER.EXE
5236	EXPL0RER.EXE
5368	EXPL0RER.EXE
5492	EXPL0RER.EXE
5612	EXPL0RER.EXE
5724	EXPL0RER.EXE
5892	EXPL0RER.EXE
5996	EXPL0RER.EXE
6100	EXPL0RER.EXE
5204	EXPL0RER.EXE
5260	EXPL0RER.EXE
5680	EXPL0RER.EXE
5988	EXPL0RER.EXE
6004	EXPL0RER.EXE
5396	EXPL0RER.EXE
5812	EXPL0RER.EXE
5852	EXPL0RER.EXE
5872	EXPL0RER.EXE
5208	EXPL0RER.EXE
5664	EXPL0RER.EXE
5128	EXPL0RER.EXE
5580	EXPL0RER.EXE
5360	EXPL0RER.EXE
6184	EXPL0RER.EXE
6372	EXPL0RER.EXE

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe
1840	cmd.exe
1556	cmd.exe
6484	cmd.exe
6828	cmd.exe
7296	cmd.exe
7880	cmd.exe
8180	cmd.exe
2576	cmd.exe
7780	cmd.exe
6476	cmd.exe
8744	cmd.exe
7496	cmd.exe
13416	cmd.exe
14052	cmd.exe
4176	cmd.exe
4620	cmd.exe
5568	cmd.exe
8184	cmd.exe
7556	cmd.exe
7348	cmd.exe
8892	cmd.exe
14896	cmd.exe
9896	cmd.exe
10052	cmd.exe
12696	cmd.exe
4864	cmd.exe
6324	cmd.exe
7004	cmd.exe
5292	cmd.exe
8916	cmd.exe
6356	cmd.exe
12960	cmd.exe
13724	cmd.exe
312	cmd.exe
6676	cmd.exe
7324	cmd.exe
8312	cmd.exe
13688	cmd.exe
14464	cmd.exe
15264	cmd.exe
14864	cmd.exe
7876	cmd.exe
5836	cmd.exe
5392	cmd.exe
6728	cmd.exe
9584	cmd.exe
15544	cmd.exe
4260	cmd.exe
1984	cmd.exe
5864	cmd.exe
9696	cmd.exe
9940	cmd.exe
12924	cmd.exe
15040	cmd.exe
13476	cmd.exe
16304	cmd.exe
2400	cmd.exe
4472	cmd.exe
1280	cmd.exe
4228	cmd.exe
7380	cmd.exe
16116	cmd.exe
16536	cmd.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
9672	4776	WerFault.exe	712
9808	10008	WerFault.exe	707
9736	9608	WerFault.exe	717
9396	9744	WerFault.exe	724
10132	9892	WerFault.exe	727
9668	8996	WerFault.exe	732
2076	9460	WerFault.exe	736
10248	9468	WerFault.exe	739
10392	10108	WerFault.exe	744
10532	10276	WerFault.exe	749
10676	10412	WerFault.exe	753
10792	10524	WerFault.exe	756
10916	10668	WerFault.exe	762
11044	10804	WerFault.exe	767
11156	10920	WerFault.exe	770
10300	11056	WerFault.exe	775
10364	11188	WerFault.exe	779
10632	10292	WerFault.exe	782
10824	10400	WerFault.exe	787
11008	10592	WerFault.exe	790
11180	10836	WerFault.exe	795
10260	10924	WerFault.exe	799
10700	11212	WerFault.exe	803
10948	10328	WerFault.exe	807
11040	8668	WerFault.exe	811
10408	10892	WerFault.exe	814
10992	11168	WerFault.exe	820
9464	10768	WerFault.exe	824
10792	9984	WerFault.exe	828
10624	10384	WerFault.exe	832
9464	10408	WerFault.exe	836
11292	11008	WerFault.exe	840
11448	10684	WerFault.exe	844
11580	11340	WerFault.exe	849
11708	11468	WerFault.exe	853
11880	11600	WerFault.exe	857
11984	11728	WerFault.exe	861
12108	11852	WerFault.exe	864
12224	11976	WerFault.exe	868
11316	12100	WerFault.exe	872
11464	12244	WerFault.exe	877
11828	11376	WerFault.exe	881
12004	11568	WerFault.exe	884
12192	11764	WerFault.exe	888
12240	12020	WerFault.exe	893
11716	12112	WerFault.exe	897
11960	12224	WerFault.exe	901
12228	11696	WerFault.exe	904
11404	11952	WerFault.exe	909
12200	11352	WerFault.exe	915
11752	12028	WerFault.exe	919
11904	9172	WerFault.exe	923
11280	11996	WerFault.exe	927
11280	11960	WerFault.exe	931
12436	12200	WerFault.exe	935
12532	12304	WerFault.exe	939
12664	12412	WerFault.exe	942
12784	12552	WerFault.exe	947
12904	12676	WerFault.exe	951
12756	12804	WerFault.exe	955
15328	15088	WerFault.exe	1080
10172	15232	WerFault.exe	1083
13816	15352	WerFault.exe	1087
14884	14300	WerFault.exe	1091

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 4424	844	jaffacakes118_fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce.exe	87
PID 844 wrote to memory of 2980	844	jaffacakes118_fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce.exe	88
PID 844 wrote to memory of 1920	844	jaffacakes118_fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce.exe	90
PID 2980 wrote to memory of 2412	2980	EXPL0RER.EXE	91
PID 2980 wrote to memory of 4984	2980	EXPL0RER.EXE	93
PID 2980 wrote to memory of 4176	2980	EXPL0RER.EXE	94
PID 4984 wrote to memory of 452	4984	EXPL0RER.EXE	95
PID 4984 wrote to memory of 1384	4984	EXPL0RER.EXE	96
PID 4984 wrote to memory of 3336	4984	EXPL0RER.EXE	98
PID 1384 wrote to memory of 992	1384	EXPL0RER.EXE	99
PID 1384 wrote to memory of 2204	1384	EXPL0RER.EXE	100
PID 1384 wrote to memory of 312	1384	EXPL0RER.EXE	101
PID 2204 wrote to memory of 3184	2204	EXPL0RER.EXE	182
PID 2204 wrote to memory of 3588	2204	EXPL0RER.EXE	103
PID 2204 wrote to memory of 4484	2204	EXPL0RER.EXE	104
PID 3588 wrote to memory of 4536	3588	EXPL0RER.EXE	105
PID 3588 wrote to memory of 628	3588	EXPL0RER.EXE	106
PID 3588 wrote to memory of 3584	3588	EXPL0RER.EXE	107
PID 628 wrote to memory of 2180	628	EXPL0RER.EXE	108
PID 628 wrote to memory of 820	628	EXPL0RER.EXE	109
PID 628 wrote to memory of 1984	628	EXPL0RER.EXE	114
PID 820 wrote to memory of 1592	820	EXPL0RER.EXE	115
PID 820 wrote to memory of 2304	820	EXPL0RER.EXE	116
PID 820 wrote to memory of 4864	820	EXPL0RER.EXE	118
PID 2304 wrote to memory of 1256	2304	EXPL0RER.EXE	229
PID 2304 wrote to memory of 4752	2304	EXPL0RER.EXE	121
PID 2304 wrote to memory of 1616	2304	EXPL0RER.EXE	122
PID 4752 wrote to memory of 5064	4752	EXPL0RER.EXE	124
PID 4752 wrote to memory of 3916	4752	EXPL0RER.EXE	125
PID 4752 wrote to memory of 3404	4752	EXPL0RER.EXE	126
PID 3916 wrote to memory of 1412	3916	EXPL0RER.EXE	127
PID 3916 wrote to memory of 2160	3916	EXPL0RER.EXE	128
PID 3916 wrote to memory of 4196	3916	EXPL0RER.EXE	129
PID 2160 wrote to memory of 3680	2160	EXPL0RER.EXE	131
PID 2160 wrote to memory of 2880	2160	EXPL0RER.EXE	132
PID 2160 wrote to memory of 1908	2160	EXPL0RER.EXE	133
PID 2880 wrote to memory of 2440	2880	EXPL0RER.EXE	134
PID 2880 wrote to memory of 3484	2880	EXPL0RER.EXE	135
PID 2880 wrote to memory of 2400	2880	EXPL0RER.EXE	138
PID 3484 wrote to memory of 2344	3484	EXPL0RER.EXE	139
PID 3484 wrote to memory of 4636	3484	EXPL0RER.EXE	140
PID 3484 wrote to memory of 1644	3484	EXPL0RER.EXE	141
PID 4636 wrote to memory of 764	4636	EXPL0RER.EXE	142
PID 4636 wrote to memory of 4072	4636	EXPL0RER.EXE	143
PID 4636 wrote to memory of 4820	4636	EXPL0RER.EXE	144
PID 4072 wrote to memory of 3260	4072	EXPL0RER.EXE	145
PID 4072 wrote to memory of 4512	4072	EXPL0RER.EXE	146
PID 4072 wrote to memory of 2420	4072	EXPL0RER.EXE	147
PID 4512 wrote to memory of 1728	4512	EXPL0RER.EXE	148
PID 4512 wrote to memory of 368	4512	EXPL0RER.EXE	149
PID 4512 wrote to memory of 4472	4512	EXPL0RER.EXE	152
PID 368 wrote to memory of 560	368	EXPL0RER.EXE	153
PID 368 wrote to memory of 960	368	EXPL0RER.EXE	154
PID 368 wrote to memory of 3800	368	EXPL0RER.EXE	156
PID 960 wrote to memory of 1428	960	EXPL0RER.EXE	157
PID 960 wrote to memory of 3292	960	EXPL0RER.EXE	158
PID 960 wrote to memory of 4964	960	EXPL0RER.EXE	163
PID 3292 wrote to memory of 3732	3292	EXPL0RER.EXE	165
PID 3292 wrote to memory of 4336	3292	EXPL0RER.EXE	166
PID 3292 wrote to memory of 4300	3292	EXPL0RER.EXE	168
PID 4336 wrote to memory of 3844	4336	EXPL0RER.EXE	169
PID 4336 wrote to memory of 2460	4336	EXPL0RER.EXE	170
PID 4336 wrote to memory of 3448	4336	EXPL0RER.EXE	171
PID 2460 wrote to memory of 4272	2460	EXPL0RER.EXE	172

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\SysWOW64\EXPL0RER.EXE
  C:\Windows\system32\EXPL0RER.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\EXPL0RER.EXE
    C:\Windows\system32\EXPL0RER.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
      4⤵
      PID:452
  - - C:\Windows\SysWOW64\EXPL0RER.EXE
      C:\Windows\system32\EXPL0RER.EXE
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        5⤵
        
        PID:992
    - - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        6⤵
        
        PID:3184
      - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        8⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        9⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        10⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        10⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        11⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        12⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        13⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        14⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        15⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        16⤵
        
        PID:764
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        17⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        19⤵
        
        PID:560
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        23⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2380
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        25⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        25⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2276
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        26⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1416
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        27⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4508
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        28⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        28⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        29⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5008
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        30⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5096
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        31⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3812
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        32⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        33⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        34⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        35⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        35⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        36⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:404
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        37⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1256
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        38⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2640
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        39⤵
        
        PID:900
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        39⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3164
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        40⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2604
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        41⤵
        
        PID:64
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        41⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        42⤵
        Executes dropped EXE
        
        PID:5236
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        44⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        45⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        45⤵
        Executes dropped EXE
        
        PID:5612
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        46⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        47⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5892
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        48⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        48⤵
        Executes dropped EXE
        
        PID:5996
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        49⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        50⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        50⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5204
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        51⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5260
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        52⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5680
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        53⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        53⤵
        Executes dropped EXE
        
        PID:5988
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        55⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5396
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        56⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        56⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5812
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        57⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5852
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        58⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        58⤵
        Executes dropped EXE
        
        PID:5872
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        59⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        59⤵
        Executes dropped EXE
        
        PID:5208
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        60⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        60⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5664
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        61⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        61⤵
        Executes dropped EXE
        
        PID:5128
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        62⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        62⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5580
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        63⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        63⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5360
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        64⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        64⤵
        Executes dropped EXE
        
        PID:6184
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        65⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        65⤵
        Executes dropped EXE
        
        PID:6372
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:6496
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        66⤵
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        67⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        67⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        68⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        68⤵
        Drops file in Windows directory
        
        PID:6756
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        69⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        69⤵
        Drops file in Windows directory
        
        PID:6880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        70⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        70⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        71⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        71⤵
        Drops file in Windows directory
        
        PID:7152
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        72⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        72⤵
        Drops file in System32 directory
        
        PID:6316
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        73⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        73⤵
        Drops file in System32 directory
        
        PID:6196
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        74⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        75⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        75⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        76⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        76⤵
        Drops file in Windows directory
        
        PID:3840
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        77⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        77⤵
        Drops file in Windows directory
        
        PID:6336
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        78⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        78⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        79⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        79⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6648
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        80⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        80⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5192
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        81⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        81⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        82⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        83⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        83⤵
        Drops file in Windows directory
        
        PID:7080
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        84⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        85⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        85⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        86⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        86⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        87⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        87⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        88⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        88⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        89⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        89⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        90⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        90⤵
        Drops file in Windows directory
        
        PID:7332
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        91⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        91⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7460
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        92⤵
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        93⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        93⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        94⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        94⤵
        Drops file in System32 directory
        
        PID:7812
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        95⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        95⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:7916
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        96⤵
        Drops file in Windows directory
        
        PID:8032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        97⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        97⤵
        Drops file in Windows directory
        
        PID:8160
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        98⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        98⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        99⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        99⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        100⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        100⤵
        Drops file in Windows directory
        
        PID:7340
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        101⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:7584
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:7892
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        102⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        103⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        103⤵
        Drops file in Windows directory
        
        PID:8152
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        104⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        104⤵
        Drops file in Windows directory
        
        PID:7284
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:7264
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        105⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6760
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        106⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        107⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        108⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        108⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        109⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        109⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        110⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        110⤵
        Drops file in System32 directory
        
        PID:1884
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        111⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:8112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        112⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        112⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        113⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        113⤵
        Drops file in Windows directory
        
        PID:8024
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        114⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        114⤵
        Drops file in System32 directory
        
        PID:4188
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        115⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        116⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        116⤵
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        117⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:8460
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        118⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:8484
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:8608
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        119⤵
        Drops file in Windows directory
        
        PID:8640
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        120⤵
        Drops file in Windows directory
        
        PID:8736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        121⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        121⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:8832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        122⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        122⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:8944
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        123⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        123⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:9140
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        124⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:9156
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        125⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        125⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        126⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        126⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:8304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        127⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        127⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        128⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        128⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:8824
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        129⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:8972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        130⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9136
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:8236
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        132⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        132⤵
        Drops file in Windows directory
        
        PID:8404
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        133⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        133⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        134⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        134⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        135⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        135⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        136⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        136⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        137⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        137⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        138⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        138⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        139⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        139⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        140⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        140⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        141⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        141⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        142⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        142⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        143⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        143⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        144⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        144⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        145⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        145⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        146⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        146⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        147⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        147⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        148⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        148⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        149⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        149⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        150⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        150⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        151⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        151⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        152⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        152⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        153⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        153⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        154⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        154⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        155⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        155⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        156⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        156⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        157⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        157⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        158⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        158⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        159⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        159⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        160⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        160⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        161⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        161⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        162⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        162⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        163⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        163⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        164⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        164⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        165⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        165⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        166⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        166⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        167⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        167⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        168⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        168⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        169⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        169⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        170⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        170⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        171⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        171⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        172⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        172⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        173⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        173⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        174⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        174⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        175⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        175⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        176⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        176⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        177⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        177⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        178⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        178⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        179⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        179⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        180⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        180⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        181⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        181⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        182⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        182⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        183⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        183⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        184⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        184⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        185⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        185⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        186⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        186⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        187⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        187⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        188⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        188⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        189⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        189⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        190⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        190⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        191⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        191⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        192⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        192⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        193⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        193⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        194⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        194⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        195⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        195⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        196⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        196⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        197⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        197⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        198⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        198⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        199⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        199⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        200⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        200⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        201⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        201⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        202⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        202⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        203⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        203⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        204⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        204⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        205⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        205⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        206⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        206⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        207⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        207⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        208⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        208⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        209⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        209⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        210⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        210⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        211⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        211⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        212⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        212⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        213⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        213⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        214⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        214⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        215⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        215⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        216⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        216⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        217⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        217⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        218⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        218⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        219⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        219⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        220⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        220⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        221⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        221⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        222⤵
        
        PID:176
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        222⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        223⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        223⤵
        
        PID:13344
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        224⤵
        
        PID:13428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        224⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        225⤵
        
        PID:13524
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        225⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        226⤵
        
        PID:13712
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        226⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        227⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        227⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        228⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        228⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        229⤵
        
        PID:14136
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        229⤵
        
        PID:14176
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        230⤵
        
        PID:14308
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        230⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        231⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        231⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        232⤵
        
        PID:13352
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        232⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        233⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        233⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        234⤵
        
        PID:13944
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        234⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        235⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        235⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        236⤵
        
        PID:14020
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        236⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        237⤵
        
        PID:14260
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        237⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        238⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        238⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        239⤵
        
        PID:13896
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        239⤵
        
        PID:13496
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        240⤵
        
        PID:532
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        240⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        241⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        241⤵
        
        PID:13932
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        242⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        242⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        243⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        243⤵
        
        PID:14304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        244⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        244⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        245⤵
        
        PID:14564
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        245⤵
        
        PID:14632
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        246⤵
        
        PID:14780
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        246⤵
        
        PID:14820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        247⤵
        
        PID:14940
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        247⤵
        
        PID:14956
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        248⤵
        
        PID:15072
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        248⤵
        
        PID:15088
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        249⤵
        
        PID:15208
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        249⤵
        
        PID:15232
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        250⤵
        
        PID:15312
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        250⤵
        
        PID:15352
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        251⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        251⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        252⤵
        
        PID:14432
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        252⤵
        
        PID:14844
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        253⤵
        
        PID:14940
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        253⤵
        
        PID:15032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        254⤵
        
        PID:15188
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        254⤵
        
        PID:15012
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        255⤵
        
        PID:15316
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        255⤵
        
        PID:15312
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        256⤵
        
        PID:536
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        256⤵
        
        PID:14424
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        257⤵
        
        PID:14980
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        257⤵
        
        PID:14696
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        258⤵
        
        PID:15220
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        258⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        259⤵
        
        PID:14564
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        259⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        260⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        260⤵
        
        PID:14828
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        261⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        261⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        262⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        262⤵
        
        PID:14784
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        263⤵
        
        PID:15428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        263⤵
        
        PID:15464
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        264⤵
        
        PID:15556
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        264⤵
        
        PID:15572
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        265⤵
        
        PID:15664
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        265⤵
        
        PID:15688
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        266⤵
        
        PID:15776
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        266⤵
        
        PID:15792
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        267⤵
        
        PID:15880
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        267⤵
        
        PID:15916
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        268⤵
        
        PID:16008
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        268⤵
        
        PID:16036
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        269⤵
        
        PID:16116
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        269⤵
        
        PID:16160
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        270⤵
        
        PID:16316
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        270⤵
        
        PID:16336
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        271⤵
        
        PID:14976
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        271⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        272⤵
        
        PID:15524
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        272⤵
        
        PID:15212
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        273⤵
        
        PID:16000
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        273⤵
        
        PID:16020
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        274⤵
        
        PID:16028
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        274⤵
        
        PID:16064
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        275⤵
        
        PID:16368
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        275⤵
        
        PID:16280
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        276⤵
        
        PID:15476
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        276⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        277⤵
        
        PID:15996
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        277⤵
        
        PID:16056
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        278⤵
        
        PID:16320
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        278⤵
        
        PID:16148
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        279⤵
        
        PID:15524
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        279⤵
        
        PID:15600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        280⤵
        
        PID:16180
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        280⤵
        
        PID:768
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        281⤵
        
        PID:15480
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        281⤵
        
        PID:15576
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        282⤵
        
        PID:14976
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        282⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        283⤵
        
        PID:15500
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        283⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        284⤵
        
        PID:16016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        284⤵
        
        PID:16072
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        285⤵
        
        PID:15484
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        285⤵
        
        PID:16340
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        286⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        286⤵
        
        PID:15552
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        287⤵
        
        PID:16076
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        287⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        288⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        288⤵
        
        PID:15644
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        289⤵
        
        PID:16416
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        289⤵
        
        PID:16444
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        290⤵
        
        PID:16556
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        290⤵
        
        PID:16572
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        291⤵
        
        PID:16676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        289⤵
        Executes a command shell one-liner
        
        PID:16536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        288⤵
        
        PID:16388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        287⤵
        
        PID:15736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        286⤵
        Executes a command shell one-liner
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        285⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        284⤵
        
        PID:15584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        283⤵
        
        PID:14976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        282⤵
        
        PID:15640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        281⤵
        
        PID:16168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        280⤵
        Executes a command shell one-liner
        
        PID:16116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        279⤵
        
        PID:15448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        278⤵
        
        PID:16220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        277⤵
        
        PID:16188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        276⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16064 -s 1220
        275⤵
        
        PID:15468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        274⤵
        
        PID:16356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        273⤵
        
        PID:16176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        272⤵
        
        PID:15788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        271⤵
        
        PID:15504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        270⤵
        
        PID:15492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        269⤵
        Executes a command shell one-liner
        
        PID:16304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15916 -s 1252
        268⤵
        
        PID:16184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15792 -s 1248
        267⤵
        
        PID:16028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        266⤵
        
        PID:15868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        265⤵
        
        PID:15764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        264⤵
        
        PID:15652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        263⤵
        Executes a command shell one-liner
        
        PID:15544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        262⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        261⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        260⤵
        
        PID:14948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        259⤵
        
        PID:14920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        258⤵
        
        PID:15188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        257⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        256⤵
        Executes a command shell one-liner
        
        PID:14864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        255⤵
        
        PID:14656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        254⤵
        Executes a command shell one-liner
        
        PID:15264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        253⤵
        Executes a command shell one-liner
        
        PID:13476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14300 -s 1192
        252⤵
        Program crash
        
        PID:14884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15352 -s 1260
        251⤵
        Program crash
        
        PID:13816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15232 -s 1212
        250⤵
        Program crash
        
        PID:10172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15088 -s 1216
        249⤵
        Program crash
        
        PID:15328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        248⤵
        
        PID:15196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        247⤵
        Executes a command shell one-liner
        
        PID:15040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        246⤵
        Executes a command shell one-liner
        
        PID:14896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        245⤵
        
        PID:14720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        244⤵
        Executes a command shell one-liner
        
        PID:14464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        243⤵
        
        PID:13840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        242⤵
        
        PID:13340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        241⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        240⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        239⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        238⤵
        Executes a command shell one-liner
        
        PID:13688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        237⤵
        Executes a command shell one-liner
        
        PID:12696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        236⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        235⤵
        Executes a command shell one-liner
        
        PID:14052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        234⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        233⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        232⤵
        Executes a command shell one-liner
        
        PID:13724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        231⤵
        
        PID:13396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        230⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        229⤵
        
        PID:14288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        228⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        227⤵
        
        PID:13952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        226⤵
        
        PID:13824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        225⤵
        
        PID:13700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        224⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        223⤵
        Executes a command shell one-liner
        
        PID:13416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        222⤵
        
        PID:13316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        221⤵
        Executes a command shell one-liner
        
        PID:12960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        220⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        219⤵
        Executes a command shell one-liner
        
        PID:12924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12804 -s 1232
        218⤵
        Program crash
        
        PID:12756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12676 -s 1252
        217⤵
        Program crash
        
        PID:12904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12552 -s 1260
        216⤵
        Program crash
        
        PID:12784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12412 -s 1260
        215⤵
        Program crash
        
        PID:12664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12304 -s 1240
        214⤵
        Program crash
        
        PID:12532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12200 -s 1212
        213⤵
        Program crash
        
        PID:12436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11960 -s 1100
        212⤵
        Program crash
        
        PID:11280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11996 -s 1256
        211⤵
        Program crash
        
        PID:11280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 1248
        210⤵
        Program crash
        
        PID:11904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12028 -s 1140
        209⤵
        Program crash
        
        PID:11752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11352 -s 1268
        208⤵
        Program crash
        
        PID:12200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11952 -s 1232
        207⤵
        Program crash
        
        PID:11404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11696 -s 1084
        206⤵
        Program crash
        
        PID:12228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12224 -s 1256
        205⤵
        Program crash
        
        PID:11960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12112 -s 1224
        204⤵
        Program crash
        
        PID:11716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12020 -s 1260
        203⤵
        Program crash
        
        PID:12240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11764 -s 1256
        202⤵
        Program crash
        
        PID:12192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11568 -s 1256
        201⤵
        Program crash
        
        PID:12004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11376 -s 1252
        200⤵
        Program crash
        
        PID:11828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12244 -s 1276
        199⤵
        Program crash
        
        PID:11464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12100 -s 1268
        198⤵
        Program crash
        
        PID:11316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11976 -s 1260
        197⤵
        Program crash
        
        PID:12224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11852 -s 1256
        196⤵
        Program crash
        
        PID:12108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11728 -s 1192
        195⤵
        Program crash
        
        PID:11984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11600 -s 1248
        194⤵
        Program crash
        
        PID:11880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11468 -s 1276
        193⤵
        Program crash
        
        PID:11708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11340 -s 1236
        192⤵
        Program crash
        
        PID:11580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10684 -s 1116
        191⤵
        Program crash
        
        PID:11448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11008 -s 1264
        190⤵
        Program crash
        
        PID:11292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10408 -s 1260
        189⤵
        Program crash
        
        PID:9464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10384 -s 1252
        188⤵
        Program crash
        
        PID:10624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9984 -s 1260
        187⤵
        Program crash
        
        PID:10792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10768 -s 1248
        186⤵
        Program crash
        
        PID:9464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11168 -s 1256
        185⤵
        Program crash
        
        PID:10992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10892 -s 1252
        184⤵
        Program crash
        
        PID:10408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8668 -s 1260
        183⤵
        Program crash
        
        PID:11040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10328 -s 1236
        182⤵
        Program crash
        
        PID:10948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11212 -s 1168
        181⤵
        Program crash
        
        PID:10700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10924 -s 1184
        180⤵
        Program crash
        
        PID:10260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10836 -s 1208
        179⤵
        Program crash
        
        PID:11180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10592 -s 1248
        178⤵
        Program crash
        
        PID:11008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10400 -s 1264
        177⤵
        Program crash
        
        PID:10824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10292 -s 1256
        176⤵
        Program crash
        
        PID:10632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11188 -s 1256
        175⤵
        Program crash
        
        PID:10364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11056 -s 1260
        174⤵
        Program crash
        
        PID:10300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10920 -s 1256
        173⤵
        Program crash
        
        PID:11156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10804 -s 1268
        172⤵
        Program crash
        
        PID:11044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10668 -s 1168
        171⤵
        Program crash
        
        PID:10916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10524 -s 1148
        170⤵
        Program crash
        
        PID:10792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10412 -s 1248
        169⤵
        Program crash
        
        PID:10676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10276 -s 1256
        168⤵
        Program crash
        
        PID:10532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10108 -s 1240
        167⤵
        Program crash
        
        PID:10392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9468 -s 1272
        166⤵
        Program crash
        
        PID:10248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9460 -s 1256
        165⤵
        Program crash
        
        PID:2076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8996 -s 1204
        164⤵
        Program crash
        
        PID:9668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9892 -s 1252
        163⤵
        Program crash
        
        PID:10132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9744 -s 1228
        162⤵
        Program crash
        
        PID:9396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9608 -s 1256
        161⤵
        Program crash
        
        PID:9736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1256
        160⤵
        Program crash
        
        PID:9672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10008 -s 1212
        159⤵
        Program crash
        
        PID:9808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        158⤵
        Executes a command shell one-liner
        
        PID:10052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        157⤵
        Executes a command shell one-liner
        
        PID:9940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        156⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        155⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        154⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        153⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        152⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        151⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        150⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        149⤵
        Executes a command shell one-liner
        
        PID:9896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        148⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        147⤵
        Executes a command shell one-liner
        
        PID:9696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        146⤵
        Executes a command shell one-liner
        
        PID:9584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        145⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        144⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        143⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        142⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        141⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        140⤵
        Executes a command shell one-liner
        
        PID:7496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        139⤵
        Executes a command shell one-liner
        
        PID:6356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        138⤵
        Executes a command shell one-liner
        
        PID:8312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        137⤵
        Executes a command shell one-liner
        
        PID:8892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        136⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        135⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        134⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        133⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        132⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        131⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        130⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        129⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        128⤵
        Executes a command shell one-liner
        
        PID:8744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        127⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        126⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        125⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        124⤵
        Executes a command shell one-liner
        
        PID:7348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        123⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        122⤵
        
        PID:9020
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        123⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        121⤵
        Executes a command shell one-liner
        
        PID:8916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        120⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        119⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        118⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        117⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        116⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        115⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        114⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        113⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        112⤵
        Executes a command shell one-liner
        
        PID:7556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        111⤵
        Executes a command shell one-liner
        
        PID:7876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        110⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        109⤵
        Executes a command shell one-liner
        
        PID:7324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        108⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        107⤵
        Executes a command shell one-liner
        
        PID:8180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        106⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        105⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        104⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        103⤵
        Executes a command shell one-liner
        
        PID:8184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        102⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        101⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        100⤵
        
        PID:7468
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        101⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        99⤵
        Executes a command shell one-liner
        
        PID:7380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        98⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        97⤵
        Executes a command shell one-liner
        
        PID:6476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        96⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        95⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        94⤵
        Executes a command shell one-liner
        
        PID:7880
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        95⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        93⤵
        Executes a command shell one-liner
        
        PID:7780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        92⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        91⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        90⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        89⤵
        Executes a command shell one-liner
        
        PID:7296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        88⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        87⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        86⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        85⤵
        Executes a command shell one-liner
        
        PID:6676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        84⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        83⤵
        Executes a command shell one-liner
        
        PID:5292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        82⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        81⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        80⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        79⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        78⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        77⤵
        
        PID:732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        76⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        75⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        73⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        72⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        71⤵
        
        PID:6172
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        72⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        70⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        69⤵
        Executes a command shell one-liner
        
        PID:7004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        68⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        67⤵
        Executes a command shell one-liner
        
        PID:6728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        67⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        65⤵
        Executes a command shell one-liner
        
        PID:6484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        64⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        63⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        62⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        61⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        60⤵
        Executes a command shell one-liner
        
        PID:5392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        59⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        58⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        57⤵
        Executes a command shell one-liner
        
        PID:5836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        56⤵
        
        PID:5980
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        57⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        55⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        54⤵
        
        PID:640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        53⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        51⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        50⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        49⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        48⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        47⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        46⤵
        Executes a command shell one-liner
        
        PID:5864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        45⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        44⤵
        Executes a command shell one-liner
        
        PID:5568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        42⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        41⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        40⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        39⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        38⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        37⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        36⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        35⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        33⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        32⤵
        Executes a command shell one-liner
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        31⤵
        Executes a command shell one-liner
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        30⤵
        Executes a command shell one-liner
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        29⤵
        Executes a command shell one-liner
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        28⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        27⤵
        Executes a command shell one-liner
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        26⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        25⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        23⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        22⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        19⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        18⤵
        Executes a command shell one-liner
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        17⤵
        Executes a command shell one-liner
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        16⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        15⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        14⤵
        Executes a command shell one-liner
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        12⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        11⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        10⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        9⤵
        Executes a command shell one-liner
        
        PID:4864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        8⤵
        Executes a command shell one-liner
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        7⤵
        
        PID:3584
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        6⤵
        
        PID:4484
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
    3⤵
    - Executes a command shell one-liner
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  PID:1920

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10008 -ip 10008
1⤵
PID:9372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4776 -ip 4776
1⤵
PID:9408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 9608 -ip 9608
1⤵
PID:9856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 9744 -ip 9744
1⤵
PID:8752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 9892 -ip 9892
1⤵
PID:9856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8996 -ip 8996
1⤵
PID:9548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 9460 -ip 9460
1⤵
PID:9840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 9468 -ip 9468
1⤵
PID:9428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 10108 -ip 10108
1⤵
PID:10360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 10276 -ip 10276
1⤵
PID:10488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10412 -ip 10412
1⤵
PID:10624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10524 -ip 10524
1⤵
PID:10752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 10668 -ip 10668
1⤵
PID:10884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 10804 -ip 10804
1⤵
PID:11008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 10920 -ip 10920
1⤵
PID:11128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 11056 -ip 11056
1⤵
PID:9372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 11188 -ip 11188
1⤵
PID:8764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 10292 -ip 10292
1⤵
PID:10516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 10400 -ip 10400
1⤵
PID:10760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 10592 -ip 10592
1⤵
PID:10948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 10836 -ip 10836
1⤵
PID:11128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 10924 -ip 10924
1⤵
PID:10312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 11212 -ip 11212
1⤵
PID:10664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 10328 -ip 10328
1⤵
PID:10696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 8668 -ip 8668
1⤵
PID:11220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 10892 -ip 10892
1⤵
PID:8432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 11168 -ip 11168
1⤵
PID:10564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 10768 -ip 10768
1⤵
PID:11196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 9984 -ip 9984
1⤵
PID:10756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 10384 -ip 10384
1⤵
PID:10260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 10408 -ip 10408
1⤵
PID:9856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 11008 -ip 11008
1⤵
PID:11272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10684 -ip 10684
1⤵
PID:11416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 11340 -ip 11340
1⤵
PID:11544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 11468 -ip 11468
1⤵
PID:11676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 11600 -ip 11600
1⤵
PID:11816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 11728 -ip 11728
1⤵
PID:11936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 11852 -ip 11852
1⤵
PID:12060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 11976 -ip 11976
1⤵
PID:12184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 12100 -ip 12100
1⤵
PID:9464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 12244 -ip 12244
1⤵
PID:11508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 11376 -ip 11376
1⤵
PID:11700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 11568 -ip 11568
1⤵
PID:11904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 11764 -ip 11764
1⤵
PID:12096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 12020 -ip 12020
1⤵
PID:11284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 12112 -ip 12112
1⤵
PID:11684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 12224 -ip 12224
1⤵
PID:11944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 11696 -ip 11696
1⤵
PID:12080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 11952 -ip 11952
1⤵
PID:9476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 11352 -ip 11352
1⤵
PID:12096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 12028 -ip 12028
1⤵
PID:11684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 9172 -ip 9172
1⤵
PID:11816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 11996 -ip 11996
1⤵
PID:11272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 11960 -ip 11960
1⤵
PID:11988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 12200 -ip 12200
1⤵
PID:12376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 12304 -ip 12304
1⤵
PID:12504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 12412 -ip 12412
1⤵
PID:12620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 12552 -ip 12552
1⤵
PID:12756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 12676 -ip 12676
1⤵
PID:12880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 12804 -ip 12804
1⤵
PID:12716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 15088 -ip 15088
1⤵
PID:15300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 15232 -ip 15232
1⤵
PID:14312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 15352 -ip 15352
1⤵
PID:14424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 14300 -ip 14300
1⤵
PID:14948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 15792 -ip 15792
1⤵
PID:15992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 15916 -ip 15916
1⤵
PID:16124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 16064 -ip 16064
1⤵
PID:16340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$336699.bat

Path C:\Users\Admin\AppData\Local\Temp\$$336699.bat
Size 323B
SHA256 433e207266245f4c6f2334fc0805ef394fcf5f85caff60fcb03e0c303f3dcc1d
MD5 0886d889ccd6ceb3a6a4e8c316dc2127
SHA1 dc9a8df254e75b8c77a41b7d63cd2449ba9aad43
SHA512 2e9358f14d250b1788c2512bd91bf3e00980804576400a86d8bfe946a9305ba60a8dd29b913a6a15db5c76076964c7c67d90d6169d0b322447870bbdfe57a4ae
TLSH
T105E0269726A78F0C2445F10B45B56B0EE0958B683ACF2F211224C4DE1292708FAA6709
MD5 SHA1 SHA512 TLSH

Submit Download

$$336699.bat

Path C:\Windows\SysWOW64\$$336699.bat
Size 141B
SHA256 a03f261cc17b929ef96c2faeef03b77af3b62ab84bbb73a79beb84878b1bfa61
MD5 e3efc16ca26ae31f9885ee9549ff1f82
SHA1 4321f47a61712ffbbad7a39691359474db4b947c
SHA512 f376e9be088782e394d21958bcdb5e7f00605b05290eff1320d64d5a76bfa619c260c8b5d971e7015bb118f0dd13ad73033f76e55b717611bc1a7d876f8e62ab
TLSH
T169C092D0A03984D2F4A2B909438E7204C74BB2F7204D3833209902D8FD28256CF53EE8
MD5 SHA1 SHA512 TLSH

Submit Download

EXPL0RER.EXE

Path C:\Windows\SysWOW64\EXPL0RER.EXE
Size 62KB
SHA256 fc744b20436788c5b66ed97ffc7e74057a182545f5718272c2c7a115433754ce
MD5 851e607c95df6b80b36f789879262d53
SHA1 ebb1cbcd2efafedf66ad08e161d28d46f567f440
SHA512 44e2b07045e5a70e144b56c6a86b6298ea6040488c25a1b5ee1945abbc75cb44e30c20ef3430abc2f38d3a5e9deab6f93a9a404f9c15857f745f491623bc9acb
SSDEEP 1536:LlqAd1s1p5h8B4/M8pQA80SkvKjRevw3ut:/d1aq5GQA80NvKjRevw3ut
TLSH
T10D536D13B5C08EB2D065CEFC5C1AD2A599277EB11CB4945BB9AD1FCE8D2D2C26D2C243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-204-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/404-359-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/628-83-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/820-94-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/844-18-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/960-215-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1256-367-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1384-50-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1416-279-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2160-138-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2204-61-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2268-255-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2276-271-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2304-105-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2380-263-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2460-247-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2604-391-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2640-375-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2880-149-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2980-28-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3164-383-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3292-227-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3484-160-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3588-72-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3736-343-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3812-319-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3916-127-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4072-182-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4080-335-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4100-399-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4148-327-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4336-238-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4388-295-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4508-287-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4512-193-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4636-171-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4752-116-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4904-351-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4984-39-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5008-303-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5096-311-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5128-559-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5204-471-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5208-543-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5236-407-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5260-479-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5360-575-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5368-415-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5396-511-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5492-423-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5580-567-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5612-431-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5664-551-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5680-487-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5724-439-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5812-519-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5852-527-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5872-535-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5892-447-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5988-495-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5996-455-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/6004-503-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/6100-463-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/6184-583-0x0000000000400000-0x0000000000415000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads