d165aa594979e1cb9f743d517d7998c4f8e3a7214b1dc889bb4f9ee86768de87

Resubmissions

14/10/2026, 18:35

261014-w8pnhsxt4m7

14/10/2026, 18:31

261014-w55kkahs218

Analysis

user interaction
yes
max time kernel
150s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/10/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
explorer.exe
Size 9.4MB
Sample261014-w55kkahs21
SHA256 d165aa594979e1cb9f743d517d7998c4f8e3a7214b1dc889bb4f9ee86768de87
MD5 3c0317be9d7918a5e148fbe6a91796b7
SHA1 7ccae555d653717975230bbb46d24c8d8ed9ddef
SHA512 f748be5cb628b582b490677d1dfdf8f4b432395ae73e8dfcfe4b8b35a67bc1db781553f5abb3730e52ad1daf136f729efa9a8fd30b227c7c8095dfc33d8d3dcb
SSDEEP 196608:6sOAVl6wtyjp7qejDFE3XIJaAglMo3buWxu7tqNNItOuMBPDGsED4:POADByjPZE34JaAgKibuf7EE9MB
TLSH
T137A633E4E3D541F6E8B3E13D8AA2C524F772792643E089DB02E006646F63BD2497DB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Loads dropped DLL 60 IoCs

pid	Process
748	explorer.exe
748	explorer.exe
748	explorer.exe
748	explorer.exe
748	explorer.exe
748	explorer.exe
748	explorer.exe
748	explorer.exe
2348	explorer.exe
2348	explorer.exe
2348	explorer.exe
2348	explorer.exe
2348	explorer.exe
2348	explorer.exe
2348	explorer.exe
2348	explorer.exe
1356	explorer.exe
1356	explorer.exe
1356	explorer.exe
1356	explorer.exe
1356	explorer.exe
1356	explorer.exe
1356	explorer.exe
1356	explorer.exe
4492	explorer.exe
4492	explorer.exe
4492	explorer.exe
4492	explorer.exe
4492	explorer.exe
4492	explorer.exe
4492	explorer.exe
4492	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
4844	explorer.exe
4844	explorer.exe
4844	explorer.exe
4844	explorer.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLoadScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLoadScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLoadScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLoadScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLoadScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLoadScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLoadScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6152	cmd.exe
13356	cmd.exe
23852	cmd.exe
26144	cmd.exe
47040	Process not Found
22868	Process not Found
11296	cmd.exe
19904	cmd.exe
22296	cmd.exe
24388	cmd.exe
48700	Process not Found
26664	Process not Found
12196	cmd.exe
7388	cmd.exe
20928	cmd.exe
21584	cmd.exe
30444	Process not Found
30004	Process not Found
16964	cmd.exe
33656	Process not Found
37472	Process not Found
25036	cmd.exe
35576	Process not Found
51064	Process not Found
23444	Process not Found
30840	Process not Found
38664	Process not Found
11480	cmd.exe
16484	cmd.exe
43740	Process not Found
21380	Process not Found
21156	Process not Found
36176	Process not Found
46592	Process not Found
12868	cmd.exe
30168	Process not Found
6200	cmd.exe
39268	Process not Found
26352	Process not Found
5140	cmd.exe
16984	cmd.exe
32436	Process not Found
11460	cmd.exe
21188	cmd.exe
27180	cmd.exe
12284	Process not Found
43096	Process not Found
8724	Process not Found
11636	cmd.exe
22364	cmd.exe
14132	cmd.exe
3896	cmd.exe
17588	cmd.exe
23092	cmd.exe
27108	Process not Found
20676	Process not Found
39180	Process not Found
6296	cmd.exe
31772	Process not Found
47024	Process not Found
18552	cmd.exe
24984	cmd.exe
40520	Process not Found
6788	cmd.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
42440	Process not Found
43272	Process not Found
8156	taskkill.exe
18044	taskkill.exe
25568	taskkill.exe
30368	Process not Found
34796	Process not Found
35820	Process not Found
41252	Process not Found
13268	Process not Found
1276	taskkill.exe
21076	taskkill.exe
29944	Process not Found
29920	Process not Found
35144	Process not Found
23792	Process not Found
11388	Process not Found
32068	Process not Found
11736	taskkill.exe
1664	Process not Found
36344	Process not Found
50100	Process not Found
8356	taskkill.exe
18052	taskkill.exe
29664	Process not Found
32212	Process not Found
29692	Process not Found
41324	Process not Found
41284	Process not Found
11256	Process not Found
29496	Process not Found
33228	Process not Found
33200	Process not Found
36312	Process not Found
11576	Process not Found
18588	Process not Found
5436	taskkill.exe
40164	Process not Found
43900	Process not Found
8872	taskkill.exe
34496	Process not Found
37036	Process not Found
49204	Process not Found
19428	taskkill.exe
25544	taskkill.exe
28592	taskkill.exe
17816	Process not Found
43876	Process not Found
49332	Process not Found
6368	taskkill.exe
23692	taskkill.exe
49040	Process not Found
11744	taskkill.exe
49132	Process not Found
40792	Process not Found
13708	taskkill.exe
10684	taskkill.exe
32984	Process not Found
43560	Process not Found
18968	Process not Found
13884	taskkill.exe
35280	Process not Found
37204	Process not Found
40832	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	272	taskkill.exe
Token: SeDebugPrivilege	3276	taskkill.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 748	4116	explorer.exe	82
PID 748 wrote to memory of 2348	748	explorer.exe	84
PID 748 wrote to memory of 4068	748	explorer.exe	85
PID 4068 wrote to memory of 3476	4068	cmd.exe	87
PID 2348 wrote to memory of 1356	2348	explorer.exe	88
PID 2348 wrote to memory of 4520	2348	explorer.exe	89
PID 1356 wrote to memory of 4492	1356	explorer.exe	93
PID 1356 wrote to memory of 2132	1356	explorer.exe	94
PID 4492 wrote to memory of 2220	4492	explorer.exe	96
PID 4492 wrote to memory of 2444	4492	explorer.exe	97
PID 2220 wrote to memory of 4036	2220	explorer.exe	99
PID 2220 wrote to memory of 1032	2220	explorer.exe	100
PID 4520 wrote to memory of 272	4520	cmd.exe	101
PID 2132 wrote to memory of 3276	2132	cmd.exe	1914
PID 4036 wrote to memory of 1636	4036	explorer.exe	105
PID 4036 wrote to memory of 2492	4036	explorer.exe	107
PID 2444 wrote to memory of 3468	2444	cmd.exe	2276
PID 1636 wrote to memory of 4844	1636	explorer.exe	109
PID 1636 wrote to memory of 2676	1636	explorer.exe	110
PID 4068 wrote to memory of 3736	4068	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\explorer.exe
"C:\Users\Admin\AppData\Local\Temp\explorer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=748" "pipe_handle=200"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
      "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=2348" "pipe_handle=400"
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1356" "pipe_handle=400"
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4492" "pipe_handle=400"
        6⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=2220" "pipe_handle=360"
        7⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4036" "pipe_handle=404"
        8⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1636" "pipe_handle=404"
        9⤵
        Loads dropped DLL
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4844" "pipe_handle=400"
        10⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4344" "pipe_handle=400"
        11⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4792" "pipe_handle=400"
        12⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=3208" "pipe_handle=400"
        13⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4276" "pipe_handle=400"
        14⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1884" "pipe_handle=404"
        15⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4524" "pipe_handle=404"
        16⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=2672" "pipe_handle=404"
        17⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=948" "pipe_handle=400"
        18⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5156" "pipe_handle=400"
        19⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5480" "pipe_handle=400"
        20⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5896" "pipe_handle=400"
        21⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6176" "pipe_handle=364"
        22⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6548" "pipe_handle=400"
        23⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6892" "pipe_handle=412"
        24⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7096" "pipe_handle=400"
        25⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7400" "pipe_handle=400"
        26⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7880" "pipe_handle=400"
        27⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8116" "pipe_handle=404"
        28⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8364" "pipe_handle=400"
        29⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8976" "pipe_handle=400"
        30⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9188" "pipe_handle=400"
        31⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9040" "pipe_handle=400"
        32⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9860" "pipe_handle=400"
        33⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5128" "pipe_handle=408"
        34⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10940" "pipe_handle=400"
        35⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11452" "pipe_handle=356"
        36⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12228" "pipe_handle=400"
        37⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4128" "pipe_handle=412"
        38⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6416" "pipe_handle=444"
        39⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12876" "pipe_handle=400"
        40⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13348" "pipe_handle=400"
        41⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14196" "pipe_handle=196"
        42⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15044" "pipe_handle=408"
        43⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15240" "pipe_handle=244"
        44⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14736" "pipe_handle=400"
        45⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15592" "pipe_handle=404"
        46⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15848" "pipe_handle=408"
        47⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8644" "pipe_handle=400"
        48⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16652" "pipe_handle=400"
        49⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16936" "pipe_handle=400"
        50⤵
        
        PID:17528
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17528" "pipe_handle=400"
        51⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17960" "pipe_handle=400"
        52⤵
        
        PID:18412
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18412" "pipe_handle=400"
        53⤵
        
        PID:19620
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19620" "pipe_handle=408"
        54⤵
        
        PID:19832
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19832" "pipe_handle=400"
        55⤵
        
        PID:20216
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20216" "pipe_handle=400"
        56⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6500" "pipe_handle=400"
        57⤵
        
        PID:22308
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22308" "pipe_handle=400"
        58⤵
        
        PID:21800
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21800" "pipe_handle=400"
        59⤵
        
        PID:23816
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23816" "pipe_handle=400"
        60⤵
        
        PID:24136
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24136" "pipe_handle=404"
        61⤵
        
        PID:24456
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24456" "pipe_handle=364"
        62⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10488" "pipe_handle=400"
        63⤵
        
        PID:27132
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27132" "pipe_handle=412"
        64⤵
        
        PID:27864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        64⤵
        
        PID:27872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        63⤵
        
        PID:27140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        62⤵
        
        PID:11020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        61⤵
        
        PID:24464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        60⤵
        
        PID:24144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        59⤵
        
        PID:23824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        58⤵
        
        PID:22540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        57⤵
        
        PID:22316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        56⤵
        
        PID:7112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        55⤵
        
        PID:19196
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        56⤵
        Kills process with taskkill
        
        PID:10684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        54⤵
        
        PID:19840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        53⤵
        
        PID:19628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        54⤵
        
        PID:26960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        52⤵
        
        PID:18420
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        53⤵
        
        PID:28372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        51⤵
        
        PID:17968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        52⤵
        
        PID:25464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        50⤵
        
        PID:17536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        51⤵
        
        PID:21372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        49⤵
        
        PID:17156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        50⤵
        
        PID:26216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        48⤵
        
        PID:16660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        49⤵
        
        PID:18692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        47⤵
        
        PID:8972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        48⤵
        
        PID:22112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        46⤵
        
        PID:15856
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        47⤵
        
        PID:25112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        45⤵
        
        PID:15608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        46⤵
        
        PID:8216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        44⤵
        
        PID:8340
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        45⤵
        
        PID:25520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        43⤵
        
        PID:15248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        44⤵
        
        PID:18672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        42⤵
        
        PID:15052
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        43⤵
        
        PID:25528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        41⤵
        
        PID:14204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        42⤵
        
        PID:17728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        40⤵
        Executes a command shell one-liner
        
        PID:13356
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        41⤵
        Kills process with taskkill
        
        PID:21076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        39⤵
        
        PID:13068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        40⤵
        
        PID:21100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        38⤵
        
        PID:4060
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        39⤵
        
        PID:21028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        37⤵
        
        PID:4132
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        38⤵
        
        PID:14272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        36⤵
        
        PID:12236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        37⤵
        
        PID:15196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        35⤵
        Executes a command shell one-liner
        
        PID:11460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        36⤵
        
        PID:15408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        34⤵
        
        PID:10948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        35⤵
        
        PID:1276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        33⤵
        
        PID:10436
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        34⤵
        
        PID:14232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        32⤵
        
        PID:9868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        33⤵
        
        PID:17712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        31⤵
        
        PID:9224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        32⤵
        
        PID:12640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        30⤵
        
        PID:9196
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        31⤵
        
        PID:12356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        29⤵
        
        PID:8984
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        30⤵
        
        PID:4464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        28⤵
        
        PID:8512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        29⤵
        
        PID:14556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        27⤵
        
        PID:4072
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        28⤵
        
        PID:12472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:7888
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        27⤵
        
        PID:8748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:7616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        26⤵
        
        PID:13172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        
        PID:7104
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        25⤵
        
        PID:6552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:6984
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        24⤵
        
        PID:6848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:6556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        23⤵
        
        PID:11068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:6184
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        22⤵
        
        PID:8608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:5904
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        21⤵
        
        PID:11220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:5600
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        20⤵
        
        PID:11200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:5248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        19⤵
        
        PID:10748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:1452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        18⤵
        
        PID:10064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:1668
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        
        PID:9604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:4900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:7648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        
        PID:2368
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        
        PID:9048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:3196
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        14⤵
        
        PID:19260
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19260" "pipe_handle=412"
        15⤵
        
        PID:19868
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19868" "pipe_handle=240"
        16⤵
        
        PID:20884
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20884" "pipe_handle=400"
        17⤵
        
        PID:21300
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21300" "pipe_handle=400"
        18⤵
        
        PID:21872
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21872" "pipe_handle=408"
        19⤵
        
        PID:22704
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22704" "pipe_handle=408"
        20⤵
        
        PID:23844
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23844" "pipe_handle=408"
        21⤵
        
        PID:24180
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24180" "pipe_handle=408"
        22⤵
        
        PID:25208
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25208" "pipe_handle=404"
        23⤵
        
        PID:26172
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=26172" "pipe_handle=400"
        24⤵
        
        PID:27064
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27064" "pipe_handle=400"
        25⤵
        
        PID:27888
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27888" "pipe_handle=400"
        26⤵
        
        PID:28528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:28536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:27904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        
        PID:27164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:26180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:25216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:24188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        Executes a command shell one-liner
        
        PID:23852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:22712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:21880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:21308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:20892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:19876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:22208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:864
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        
        PID:6712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:3084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        10⤵
        
        PID:4540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        
        PID:6764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        9⤵
        
        PID:2676
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        Kills process with taskkill
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        10⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15224" "pipe_handle=412"
        11⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14620" "pipe_handle=404"
        12⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15524" "pipe_handle=404"
        13⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15824" "pipe_handle=404"
        14⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15680" "pipe_handle=404"
        15⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16780" "pipe_handle=400"
        16⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9184" "pipe_handle=400"
        17⤵
        
        PID:17808
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17808" "pipe_handle=400"
        18⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18180" "pipe_handle=400"
        19⤵
        
        PID:18528
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18528" "pipe_handle=400"
        20⤵
        
        PID:19636
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19636" "pipe_handle=404"
        21⤵
        
        PID:19912
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19912" "pipe_handle=364"
        22⤵
        
        PID:20620
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20620" "pipe_handle=400"
        23⤵
        
        PID:21392
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21392" "pipe_handle=404"
        24⤵
        
        PID:22464
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22464" "pipe_handle=400"
        25⤵
        
        PID:23160
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23160" "pipe_handle=400"
        26⤵
        
        PID:23512
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23512" "pipe_handle=400"
        27⤵
        
        PID:24068
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24068" "pipe_handle=400"
        28⤵
        
        PID:24380
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24380" "pipe_handle=404"
        29⤵
        
        PID:25028
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25028" "pipe_handle=400"
        30⤵
        
        PID:25720
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25720" "pipe_handle=400"
        31⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10508" "pipe_handle=400"
        32⤵
        
        PID:27220
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27220" "pipe_handle=408"
        33⤵
        
        PID:27984
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27984" "pipe_handle=400"
        34⤵
        
        PID:28624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        34⤵
        
        PID:28632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        33⤵
        
        PID:27996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        32⤵
        
        PID:27228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        31⤵
        
        PID:25652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        30⤵
        
        PID:25728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        29⤵
        Executes a command shell one-liner
        
        PID:25036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        28⤵
        Executes a command shell one-liner
        
        PID:24388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        27⤵
        
        PID:24076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:23520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:23168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        
        PID:20780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        25⤵
        
        PID:26808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:21400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:20900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:19920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:19644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:18536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        20⤵
        
        PID:22196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:18188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:17952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:8732
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        
        PID:24400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:16788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:2680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        
        PID:5768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        
        PID:25424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:15832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        Kills process with taskkill
        
        PID:25568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:15532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        
        PID:24852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:4180
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:20228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        8⤵
        
        PID:2492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        Kills process with taskkill
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        9⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16580" "pipe_handle=424"
        10⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16976" "pipe_handle=400"
        11⤵
        
        PID:17600
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17600" "pipe_handle=408"
        12⤵
        
        PID:18364
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18364" "pipe_handle=400"
        13⤵
        
        PID:18784
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18784" "pipe_handle=400"
        14⤵
        
        PID:19132
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19132" "pipe_handle=412"
        15⤵
        
        PID:19952
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19952" "pipe_handle=404"
        16⤵
        
        PID:20936
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20936" "pipe_handle=400"
        17⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9908" "pipe_handle=404"
        18⤵
        
        PID:22120
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22120" "pipe_handle=364"
        19⤵
        
        PID:23024
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23024" "pipe_handle=400"
        20⤵
        
        PID:22564
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22564" "pipe_handle=400"
        21⤵
        
        PID:24360
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24360" "pipe_handle=400"
        22⤵
        
        PID:25240
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25240" "pipe_handle=404"
        23⤵
        
        PID:26872
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=26872" "pipe_handle=400"
        24⤵
        
        PID:27172
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27172" "pipe_handle=400"
        25⤵
        
        PID:28192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:28200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        Executes a command shell one-liner
        
        PID:27180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:26880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:25248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:24368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:22672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:23036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:22128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        19⤵
        Kills process with taskkill
        
        PID:28592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:21604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:20944
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        
        PID:21812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:19960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        
        PID:19140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:18808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:18372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:17616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:20408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        10⤵
        Executes a command shell one-liner
        
        PID:16984
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        
        PID:24228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        7⤵
        
        PID:1032
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        8⤵
        
        PID:2528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7780" "pipe_handle=412"
        8⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8032" "pipe_handle=400"
        9⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=3484" "pipe_handle=400"
        10⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8728" "pipe_handle=400"
        11⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9312" "pipe_handle=400"
        12⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9524" "pipe_handle=404"
        13⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10224" "pipe_handle=396"
        14⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10808" "pipe_handle=404"
        15⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11072" "pipe_handle=408"
        16⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11436" "pipe_handle=404"
        17⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5996" "pipe_handle=408"
        18⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10540" "pipe_handle=408"
        19⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12596" "pipe_handle=400"
        20⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13040" "pipe_handle=400"
        21⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13244" "pipe_handle=408"
        22⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13368" "pipe_handle=400"
        23⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13900" "pipe_handle=400"
        24⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14140" "pipe_handle=408"
        25⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14508" "pipe_handle=408"
        26⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14748" "pipe_handle=400"
        27⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15392" "pipe_handle=400"
        28⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16472" "pipe_handle=404"
        29⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16760" "pipe_handle=400"
        30⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16956" "pipe_handle=400"
        31⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18336" "pipe_handle=404"
        32⤵
        
        PID:18560
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18560" "pipe_handle=400"
        33⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5640" "pipe_handle=400"
        34⤵
        
        PID:19932
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19932" "pipe_handle=408"
        35⤵
        
        PID:20584
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20584" "pipe_handle=400"
        36⤵
        
        PID:20868
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20868" "pipe_handle=404"
        37⤵
        
        PID:21220
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21220" "pipe_handle=400"
        38⤵
        
        PID:21540
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21540" "pipe_handle=400"
        39⤵
        
        PID:22976
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22976" "pipe_handle=236"
        40⤵
        
        PID:23376
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23376" "pipe_handle=400"
        41⤵
        
        PID:24052
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24052" "pipe_handle=400"
        42⤵
        
        PID:24652
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24652" "pipe_handle=404"
        43⤵
        
        PID:26136
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=26136" "pipe_handle=412"
        44⤵
        
        PID:27352
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27352" "pipe_handle=364"
        45⤵
        
        PID:28604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        45⤵
        
        PID:28612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        44⤵
        
        PID:27360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        43⤵
        Executes a command shell one-liner
        
        PID:26144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        42⤵
        
        PID:24660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        43⤵
        
        PID:28136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        41⤵
        
        PID:24060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        40⤵
        
        PID:23384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        39⤵
        
        PID:23000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        38⤵
        Executes a command shell one-liner
        
        PID:21584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        37⤵
        
        PID:21228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        36⤵
        
        PID:20876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        35⤵
        
        PID:20592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        34⤵
        
        PID:19940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        33⤵
        
        PID:18836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        32⤵
        
        PID:18568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        31⤵
        
        PID:17916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        30⤵
        Executes a command shell one-liner
        
        PID:16964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        31⤵
        
        PID:25472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        29⤵
        
        PID:16768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        28⤵
        Executes a command shell one-liner
        
        PID:16484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        29⤵
        Kills process with taskkill
        
        PID:23692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        27⤵
        
        PID:15400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        28⤵
        
        PID:25560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:14764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        27⤵
        
        PID:25432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:14516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        26⤵
        Kills process with taskkill
        
        PID:25544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        
        PID:14148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        25⤵
        
        PID:20696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:13912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        24⤵
        
        PID:8056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:13376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        23⤵
        
        PID:21068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:13252
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        22⤵
        
        PID:21060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:13048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        21⤵
        
        PID:15348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:12604
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        20⤵
        
        PID:21036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:11888
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        19⤵
        
        PID:21092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:5900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        18⤵
        Kills process with taskkill
        
        PID:19428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:11444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        
        PID:19164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:11080
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:18008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        
        PID:10816
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        
        PID:18652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:4932
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        
        PID:18028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:9688
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        
        PID:11832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:9320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:3192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        10⤵
        
        PID:8936
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        
        PID:10412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        9⤵
        
        PID:8332
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        
        PID:11976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        8⤵
        
        PID:8040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        Kills process with taskkill
        
        PID:13708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2132
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1804" "pipe_handle=412"
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4304" "pipe_handle=400"
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4500" "pipe_handle=400"
        9⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5368" "pipe_handle=404"
        10⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5880" "pipe_handle=400"
        11⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6040" "pipe_handle=400"
        12⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6004" "pipe_handle=400"
        13⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6288" "pipe_handle=412"
        14⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6444" "pipe_handle=400"
        15⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6608" "pipe_handle=412"
        16⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6952" "pipe_handle=400"
        17⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=2656" "pipe_handle=400"
        18⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7368" "pipe_handle=404"
        19⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7572" "pipe_handle=400"
        20⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7904" "pipe_handle=400"
        21⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4340" "pipe_handle=360"
        22⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8664" "pipe_handle=408"
        23⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8808" "pipe_handle=404"
        24⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9304" "pipe_handle=404"
        25⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9788" "pipe_handle=404"
        26⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10232" "pipe_handle=404"
        27⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10844" "pipe_handle=364"
        28⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11288" "pipe_handle=400"
        29⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11628" "pipe_handle=400"
        30⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10524" "pipe_handle=400"
        31⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6180" "pipe_handle=400"
        32⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12324" "pipe_handle=244"
        33⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13076" "pipe_handle=400"
        34⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13288" "pipe_handle=408"
        35⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13632" "pipe_handle=392"
        36⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14124" "pipe_handle=404"
        37⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14416" "pipe_handle=408"
        38⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14628" "pipe_handle=404"
        39⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15268" "pipe_handle=404"
        40⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8496" "pipe_handle=400"
        41⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16280" "pipe_handle=400"
        42⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16864" "pipe_handle=396"
        43⤵
        
        PID:17580
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17580" "pipe_handle=400"
        44⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18312" "pipe_handle=404"
        45⤵
        
        PID:19088
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19088" "pipe_handle=404"
        46⤵
        
        PID:20452
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20452" "pipe_handle=400"
        47⤵
        
        PID:21252
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21252" "pipe_handle=404"
        48⤵
        
        PID:19712
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19712" "pipe_handle=408"
        49⤵
        
        PID:21936
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21936" "pipe_handle=400"
        50⤵
        
        PID:22232
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22232" "pipe_handle=408"
        51⤵
        
        PID:22812
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22812" "pipe_handle=408"
        52⤵
        
        PID:23144
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23144" "pipe_handle=400"
        53⤵
        
        PID:23468
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23468" "pipe_handle=408"
        54⤵
        
        PID:23916
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23916" "pipe_handle=404"
        55⤵
        
        PID:24252
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24252" "pipe_handle=400"
        56⤵
        
        PID:24996
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24996" "pipe_handle=400"
        57⤵
        
        PID:25308
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25308" "pipe_handle=400"
        58⤵
        
        PID:25664
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25664" "pipe_handle=420"
        59⤵
        
        PID:26188
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=26188" "pipe_handle=400"
        60⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10876" "pipe_handle=412"
        61⤵
        
        PID:27656
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27656" "pipe_handle=400"
        62⤵
        
        PID:28328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        62⤵
        
        PID:28336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        61⤵
        
        PID:27664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        60⤵
        
        PID:25604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        59⤵
        
        PID:26196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        58⤵
        
        PID:25680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        57⤵
        
        PID:25316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        56⤵
        
        PID:25004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        55⤵
        
        PID:24260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        54⤵
        
        PID:23924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        53⤵
        
        PID:23476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        52⤵
        
        PID:23152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        51⤵
        
        PID:22820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        50⤵
        
        PID:22240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        49⤵
        
        PID:21944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        48⤵
        
        PID:9316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        47⤵
        
        PID:21260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        46⤵
        
        PID:20460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        45⤵
        
        PID:19096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        44⤵
        
        PID:18320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        43⤵
        Executes a command shell one-liner
        
        PID:17588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        44⤵
        
        PID:25956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        42⤵
        
        PID:17088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        43⤵
        
        PID:25584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        41⤵
        
        PID:16288
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        42⤵
        
        PID:23700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        40⤵
        
        PID:8308
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        41⤵
        
        PID:25440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        39⤵
        
        PID:15276
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        40⤵
        
        PID:26224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        38⤵
        
        PID:14636
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        39⤵
        
        PID:24860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        37⤵
        
        PID:14424
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        38⤵
        
        PID:18712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        36⤵
        Executes a command shell one-liner
        
        PID:14132
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        37⤵
        
        PID:23664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        35⤵
        
        PID:13640
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        36⤵
        
        PID:21052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        34⤵
        
        PID:13296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        35⤵
        
        PID:17840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        33⤵
        
        PID:13084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        34⤵
        
        PID:15336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        32⤵
        
        PID:12340
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        33⤵
        
        PID:19328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        31⤵
        
        PID:11964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        32⤵
        
        PID:15324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        30⤵
        
        PID:10432
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        31⤵
        
        PID:14252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        29⤵
        Executes a command shell one-liner
        
        PID:11636
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        30⤵
        
        PID:19468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        28⤵
        Executes a command shell one-liner
        
        PID:11296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        29⤵
        
        PID:13836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        27⤵
        
        PID:10852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        28⤵
        
        PID:18036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:3320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        27⤵
        
        PID:25120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:9992
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        26⤵
        Kills process with taskkill
        
        PID:18044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        
        PID:9332
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        25⤵
        
        PID:11568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:9004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        24⤵
        
        PID:10292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:8672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        23⤵
        
        PID:14572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:8200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        22⤵
        
        PID:14528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:7912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        21⤵
        
        PID:9884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:7588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        20⤵
        Kills process with taskkill
        
        PID:8356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:7376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        19⤵
        
        PID:6396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:7020
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        18⤵
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:6992
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        
        PID:10984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:6616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        
        PID:6452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        
        PID:11400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        Executes a command shell one-liner
        
        PID:6296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        
        PID:7272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:6036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        
        PID:7040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:6064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:7240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        10⤵
        
        PID:5888
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        
        PID:11532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        9⤵
        
        PID:5376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        
        PID:10756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        8⤵
        
        PID:868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        
        PID:8272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        7⤵
        
        PID:3400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        8⤵
        
        PID:3164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:272
    - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1684" "pipe_handle=412"
        6⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4368" "pipe_handle=408"
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5232" "pipe_handle=400"
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5536" "pipe_handle=400"
        9⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6080" "pipe_handle=400"
        10⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=772" "pipe_handle=400"
        11⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6312" "pipe_handle=400"
        12⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6488" "pipe_handle=356"
        13⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7048" "pipe_handle=400"
        14⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7280" "pipe_handle=408"
        15⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7832" "pipe_handle=412"
        16⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5040" "pipe_handle=400"
        17⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8564" "pipe_handle=408"
        18⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9396" "pipe_handle=400"
        19⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9800" "pipe_handle=400"
        20⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10008" "pipe_handle=400"
        21⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9740" "pipe_handle=400"
        22⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10504" "pipe_handle=364"
        23⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10912" "pipe_handle=400"
        24⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11472" "pipe_handle=412"
        25⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11644" "pipe_handle=400"
        26⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=3552" "pipe_handle=400"
        27⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7092" "pipe_handle=248"
        28⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12844" "pipe_handle=408"
        29⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13216" "pipe_handle=400"
        30⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13760" "pipe_handle=400"
        31⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14168" "pipe_handle=400"
        32⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14812" "pipe_handle=400"
        33⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15180" "pipe_handle=400"
        34⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15440" "pipe_handle=400"
        35⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15800" "pipe_handle=404"
        36⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16436" "pipe_handle=400"
        37⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16716" "pipe_handle=400"
        38⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17040" "pipe_handle=408"
        39⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17472" "pipe_handle=400"
        40⤵
        
        PID:18140
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18140" "pipe_handle=400"
        41⤵
        
        PID:18544
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18544" "pipe_handle=404"
        42⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18800" "pipe_handle=404"
        43⤵
        
        PID:21180
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21180" "pipe_handle=400"
        44⤵
        
        PID:21492
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21492" "pipe_handle=400"
        45⤵
        
        PID:21968
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21968" "pipe_handle=408"
        46⤵
        
        PID:22352
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22352" "pipe_handle=400"
        47⤵
        
        PID:23420
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23420" "pipe_handle=400"
        48⤵
        
        PID:24160
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24160" "pipe_handle=408"
        49⤵
        
        PID:25324
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25324" "pipe_handle=408"
        50⤵
        
        PID:25692
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25692" "pipe_handle=400"
        51⤵
        
        PID:27192
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27192" "pipe_handle=408"
        52⤵
        
        PID:27944
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27944" "pipe_handle=404"
        53⤵
        
        PID:28348
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=28348" "pipe_handle=400"
        54⤵
        
        PID:28708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        53⤵
        
        PID:28356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        52⤵
        
        PID:27952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        51⤵
        
        PID:27200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        50⤵
        
        PID:25700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        49⤵
        
        PID:25332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        48⤵
        
        PID:24168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        47⤵
        
        PID:23428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        46⤵
        Executes a command shell one-liner
        
        PID:22364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        45⤵
        
        PID:21976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        44⤵
        
        PID:21500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        43⤵
        Executes a command shell one-liner
        
        PID:21188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        42⤵
        
        PID:19072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        41⤵
        Executes a command shell one-liner
        
        PID:18552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        40⤵
        
        PID:18148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        41⤵
        
        PID:25488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        39⤵
        
        PID:17480
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        40⤵
        
        PID:26256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        38⤵
        
        PID:17048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        39⤵
        
        PID:23708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        37⤵
        
        PID:16724
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        38⤵
        
        PID:25456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        36⤵
        
        PID:16444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        37⤵
        
        PID:25496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        35⤵
        
        PID:15808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        36⤵
        
        PID:25552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        34⤵
        
        PID:15448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        35⤵
        
        PID:25448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        33⤵
        
        PID:15188
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        34⤵
        
        PID:18728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        32⤵
        
        PID:14824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        33⤵
        
        PID:25504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        31⤵
        
        PID:14176
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        32⤵
        
        PID:20992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        30⤵
        
        PID:13768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        31⤵
        
        PID:21044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        29⤵
        
        PID:13224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        30⤵
        
        PID:23656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        28⤵
        
        PID:12852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        29⤵
        
        PID:4836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        27⤵
        
        PID:6732
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        28⤵
        
        PID:17832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:4108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        27⤵
        
        PID:19460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:11652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        26⤵
        
        PID:19124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        Executes a command shell one-liner
        
        PID:11480
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        25⤵
        
        PID:19436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:10920
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        24⤵
        
        PID:18640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:10708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        23⤵
        
        PID:14340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:10304
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        22⤵
        
        PID:20720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:10016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        21⤵
        
        PID:15376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:9808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        20⤵
        
        PID:17328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:9616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        19⤵
        
        PID:16992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:9144
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        18⤵
        
        PID:15876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:8228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        
        PID:14548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:8092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:7576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        
        PID:7424
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        Kills process with taskkill
        
        PID:13884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:7056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        Kills process with taskkill
        
        PID:8156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:6664
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        
        PID:8076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:6320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:12276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        10⤵
        Executes a command shell one-liner
        
        PID:6152
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        
        PID:8600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        9⤵
        
        PID:6088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        10⤵
        
        PID:21172
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21172" "pipe_handle=416"
        11⤵
        
        PID:21448
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21448" "pipe_handle=408"
        12⤵
        
        PID:22264
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22264" "pipe_handle=400"
        13⤵
        
        PID:22752
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22752" "pipe_handle=400"
        14⤵
        
        PID:23084
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23084" "pipe_handle=400"
        15⤵
        
        PID:23452
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23452" "pipe_handle=120"
        16⤵
        
        PID:25012
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25012" "pipe_handle=400"
        17⤵
        
        PID:25376
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25376" "pipe_handle=400"
        18⤵
        
        PID:27916
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27916" "pipe_handle=400"
        19⤵
        
        PID:28676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:28684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:27924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:25384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:25020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:23460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        Executes a command shell one-liner
        
        PID:23092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:22764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:22272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:21456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        8⤵
        
        PID:5676
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        
        PID:11352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        7⤵
        
        PID:5400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        8⤵
        
        PID:10976
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        6⤵
        
        PID:1928
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        7⤵
        
        PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
      explorer.exe
      4⤵
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=3736" "pipe_handle=412"
        5⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=2940" "pipe_handle=408"
        6⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1364" "pipe_handle=400"
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1596" "pipe_handle=400"
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=3980" "pipe_handle=356"
        9⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=232" "pipe_handle=400"
        10⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5104" "pipe_handle=400"
        11⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1780" "pipe_handle=404"
        12⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5132" "pipe_handle=408"
        13⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5508" "pipe_handle=408"
        14⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5952" "pipe_handle=412"
        15⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6192" "pipe_handle=400"
        16⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6536" "pipe_handle=396"
        17⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6912" "pipe_handle=404"
        18⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7128" "pipe_handle=400"
        19⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7464" "pipe_handle=392"
        20⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8144" "pipe_handle=412"
        21⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8544" "pipe_handle=408"
        22⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9168" "pipe_handle=400"
        23⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9440" "pipe_handle=404"
        24⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9816" "pipe_handle=404"
        25⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10040" "pipe_handle=400"
        26⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10276" "pipe_handle=400"
        27⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10484" "pipe_handle=400"
        28⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10880" "pipe_handle=252"
        29⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11272" "pipe_handle=408"
        30⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11752" "pipe_handle=404"
        31⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4416" "pipe_handle=400"
        32⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4052" "pipe_handle=400"
        33⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12860" "pipe_handle=400"
        34⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12464" "pipe_handle=400"
        35⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13564" "pipe_handle=396"
        36⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13788" "pipe_handle=400"
        37⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7800" "pipe_handle=400"
        38⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14432" "pipe_handle=400"
        39⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14924" "pipe_handle=408"
        40⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15284" "pipe_handle=400"
        41⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15740" "pipe_handle=400"
        42⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=15104" "pipe_handle=400"
        43⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16684" "pipe_handle=400"
        44⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17412" "pipe_handle=400"
        45⤵
        
        PID:17788
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17788" "pipe_handle=400"
        46⤵
        
        PID:18196
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18196" "pipe_handle=404"
        47⤵
        
        PID:19056
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19056" "pipe_handle=400"
        48⤵
        
        PID:20160
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20160" "pipe_handle=400"
        49⤵
        
        PID:21432
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21432" "pipe_handle=400"
        50⤵
        
        PID:22288
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22288" "pipe_handle=400"
        51⤵
        
        PID:23068
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23068" "pipe_handle=404"
        52⤵
        
        PID:21988
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21988" "pipe_handle=400"
        53⤵
        
        PID:24084
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24084" "pipe_handle=392"
        54⤵
        
        PID:25044
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25044" "pipe_handle=400"
        55⤵
        
        PID:25392
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25392" "pipe_handle=400"
        56⤵
        
        PID:10884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        56⤵
        
        PID:27040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        55⤵
        
        PID:25400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        54⤵
        
        PID:25052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        53⤵
        
        PID:24092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        52⤵
        
        PID:10044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        51⤵
        
        PID:23076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        50⤵
        Executes a command shell one-liner
        
        PID:22296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        49⤵
        
        PID:21440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        48⤵
        
        PID:18904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        47⤵
        
        PID:19064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        46⤵
        
        PID:1680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        45⤵
        
        PID:17796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        44⤵
        
        PID:17420
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        45⤵
        
        PID:25592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        43⤵
        
        PID:16692
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        44⤵
        
        PID:24452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        42⤵
        
        PID:10868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        43⤵
        
        PID:25576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        41⤵
        
        PID:15748
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        42⤵
        
        PID:25512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        40⤵
        
        PID:15292
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        41⤵
        
        PID:23532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        39⤵
        
        PID:14932
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        40⤵
        
        PID:21552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        38⤵
        
        PID:14440
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        39⤵
        
        PID:25416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        37⤵
        Executes a command shell one-liner
        
        PID:7388
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        38⤵
        
        PID:24844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        36⤵
        
        PID:13796
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        37⤵
        
        PID:20236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        35⤵
        
        PID:13572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        36⤵
        
        PID:21020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        34⤵
        
        PID:12456
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        35⤵
        
        PID:21012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        33⤵
        Executes a command shell one-liner
        
        PID:12868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        34⤵
        
        PID:21324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        32⤵
        
        PID:3644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        33⤵
        
        PID:19344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        31⤵
        
        PID:6044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        32⤵
        
        PID:19300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        30⤵
        
        PID:11760
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        31⤵
        
        PID:18912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        29⤵
        
        PID:11280
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        30⤵
        
        PID:7948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        28⤵
        
        PID:10888
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        29⤵
        Kills process with taskkill
        
        PID:18052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        27⤵
        
        PID:10696
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        28⤵
        
        PID:22220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:10284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        27⤵
        
        PID:14024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:10048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        26⤵
        
        PID:16920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        
        PID:9824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        25⤵
        
        PID:17000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:9456
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        24⤵
        
        PID:16120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:8804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        23⤵
        
        PID:16396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:8692
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        22⤵
        
        PID:2200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:8108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        21⤵
        
        PID:10180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:7560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        20⤵
        
        PID:13308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:7136
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        19⤵
        
        PID:7684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:6920
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        18⤵
        Kills process with taskkill
        
        PID:6368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:6696
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        Kills process with taskkill
        
        PID:8872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        Executes a command shell one-liner
        
        PID:6200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:12268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        
        PID:6072
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        Kills process with taskkill
        
        PID:11744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:5632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        
        PID:10764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        Executes a command shell one-liner
        
        PID:5140
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        
        PID:7640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:4156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:6880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        10⤵
        
        PID:1064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        9⤵
        
        PID:5072
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        
        PID:5456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        8⤵
        
        PID:4460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        
        PID:8260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        7⤵
        
        PID:4016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        8⤵
        
        PID:8208
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        6⤵
        
        PID:4192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        7⤵
        
        PID:7356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        5⤵
        
        PID:3500
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:26556
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=26556" "pipe_handle=412"
        7⤵
        
        PID:27880
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27880" "pipe_handle=408"
        8⤵
        
        PID:28692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        8⤵
        
        PID:28700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        7⤵
        
        PID:27896

C:\Users\Admin\AppData\Local\Temp\explorer.exe
C:\Users\Admin\AppData\Local\Temp\explorer.exe
1⤵
PID:4884
- C:\Users\Admin\AppData\Local\Temp\explorer.exe
  C:\Users\Admin\AppData\Local\Temp\explorer.exe
  2⤵
  PID:4308
- - C:\Users\Admin\AppData\Local\Temp\explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4308" "pipe_handle=400"
    3⤵
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
      "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5028" "pipe_handle=120"
      4⤵
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=1080" "pipe_handle=360"
        5⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4320" "pipe_handle=400"
        6⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=4288" "pipe_handle=400"
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5016" "pipe_handle=412"
        8⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=2556" "pipe_handle=408"
        9⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5304" "pipe_handle=392"
        10⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5560" "pipe_handle=396"
        11⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=5840" "pipe_handle=412"
        12⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6100" "pipe_handle=408"
        13⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6412" "pipe_handle=408"
        14⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6640" "pipe_handle=400"
        15⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7200" "pipe_handle=400"
        16⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7384" "pipe_handle=400"
        17⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7580" "pipe_handle=404"
        18⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=7764" "pipe_handle=404"
        19⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8004" "pipe_handle=408"
        20⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=3824" "pipe_handle=400"
        21⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8504" "pipe_handle=404"
        22⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=8844" "pipe_handle=356"
        23⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9084" "pipe_handle=400"
        24⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9344" "pipe_handle=400"
        25⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9540" "pipe_handle=404"
        26⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=9768" "pipe_handle=404"
        27⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10316" "pipe_handle=400"
        28⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=10572" "pipe_handle=404"
        29⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11048" "pipe_handle=400"
        30⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11372" "pipe_handle=408"
        31⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=11800" "pipe_handle=400"
        32⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12188" "pipe_handle=404"
        33⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=6388" "pipe_handle=408"
        34⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12316" "pipe_handle=364"
        35⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13016" "pipe_handle=400"
        36⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=12896" "pipe_handle=400"
        37⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=13972" "pipe_handle=396"
        38⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=14740" "pipe_handle=408"
        39⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=2028" "pipe_handle=404"
        40⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16140" "pipe_handle=400"
        41⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16540" "pipe_handle=408"
        42⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=16800" "pipe_handle=400"
        43⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17456" "pipe_handle=400"
        44⤵
        
        PID:17740
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=17740" "pipe_handle=400"
        45⤵
        
        PID:18160
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18160" "pipe_handle=400"
        46⤵
        
        PID:18396
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=18396" "pipe_handle=400"
        47⤵
        
        PID:19232
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19232" "pipe_handle=400"
        48⤵
        
        PID:19896
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=19896" "pipe_handle=400"
        49⤵
        
        PID:20604
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20604" "pipe_handle=364"
        50⤵
        
        PID:20920
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=20920" "pipe_handle=400"
        51⤵
        
        PID:21952
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=21952" "pipe_handle=404"
        52⤵
        
        PID:22248
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22248" "pipe_handle=400"
        53⤵
        
        PID:22828
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=22828" "pipe_handle=400"
        54⤵
        
        PID:23540
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=23540" "pipe_handle=400"
        55⤵
        
        PID:24104
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24104" "pipe_handle=412"
        56⤵
        
        PID:24628
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24628" "pipe_handle=400"
        57⤵
        
        PID:24976
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=24976" "pipe_handle=400"
        58⤵
        
        PID:25348
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25348" "pipe_handle=404"
        59⤵
        
        PID:25740
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=25740" "pipe_handle=400"
        60⤵
        
        PID:26156
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=26156" "pipe_handle=400"
        61⤵
        
        PID:26044
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=26044" "pipe_handle=408"
        62⤵
        
        PID:27148
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27148" "pipe_handle=404"
        63⤵
        
        PID:27568
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=27568" "pipe_handle=400"
        64⤵
        
        PID:28296
        
        C:\Users\Admin\AppData\Local\Temp\explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "--multiprocessing-fork" "parent_pid=28296" "pipe_handle=408"
        65⤵
        
        PID:28572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        65⤵
        
        PID:28580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        64⤵
        
        PID:28304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        63⤵
        
        PID:27576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        62⤵
        
        PID:27156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        61⤵
        
        PID:26632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        60⤵
        
        PID:26164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        59⤵
        
        PID:25748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        58⤵
        
        PID:25356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        57⤵
        Executes a command shell one-liner
        
        PID:24984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        56⤵
        
        PID:24636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        55⤵
        
        PID:24112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        54⤵
        
        PID:23548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        55⤵
        
        PID:27752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        53⤵
        
        PID:23176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        52⤵
        
        PID:22256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        51⤵
        
        PID:21960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        50⤵
        Executes a command shell one-liner
        
        PID:20928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        49⤵
        
        PID:20612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        48⤵
        Executes a command shell one-liner
        
        PID:19904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        47⤵
        
        PID:19244
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        48⤵
        
        PID:26232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        46⤵
        
        PID:18404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        47⤵
        
        PID:23292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        45⤵
        
        PID:18168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        44⤵
        
        PID:17752
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        45⤵
        
        PID:25480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        43⤵
        
        PID:17464
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        44⤵
        
        PID:26208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        42⤵
        
        PID:16808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        43⤵
        
        PID:10464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        41⤵
        
        PID:16548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        42⤵
        
        PID:22724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        40⤵
        
        PID:16148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        41⤵
        
        PID:24592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        39⤵
        
        PID:2824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        40⤵
        
        PID:25536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        38⤵
        
        PID:14756
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        39⤵
        
        PID:23988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        37⤵
        
        PID:13980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        38⤵
        
        PID:8048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        36⤵
        
        PID:2616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        37⤵
        
        PID:21676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        35⤵
        
        PID:13024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        36⤵
        
        PID:21004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        34⤵
        
        PID:12332
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        35⤵
        
        PID:18612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        33⤵
        
        PID:6148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        34⤵
        
        PID:21084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        32⤵
        Executes a command shell one-liner
        
        PID:12196
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        33⤵
        
        PID:19172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        31⤵
        
        PID:11808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        32⤵
        
        PID:19152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        30⤵
        
        PID:11380
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        31⤵
        
        PID:18620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        29⤵
        
        PID:11056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        30⤵
        
        PID:13552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        28⤵
        
        PID:10792
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        29⤵
        
        PID:14240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        27⤵
        
        PID:10324
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        28⤵
        
        PID:20704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        26⤵
        
        PID:3628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        27⤵
        
        PID:18880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        25⤵
        
        PID:9548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        26⤵
        
        PID:10596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        24⤵
        
        PID:9352
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        25⤵
        
        PID:15424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        23⤵
        
        PID:9092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        24⤵
        
        PID:12664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        22⤵
        
        PID:8852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        23⤵
        
        PID:12480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        21⤵
        
        PID:8680
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        22⤵
        
        PID:14564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        20⤵
        
        PID:480
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        21⤵
        
        PID:13928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        19⤵
        
        PID:8176
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        20⤵
        
        PID:7700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        18⤵
        
        PID:7772
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        19⤵
        
        PID:13696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        17⤵
        
        PID:7600
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        18⤵
        
        PID:13156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        16⤵
        
        PID:7392
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        
        PID:7008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        15⤵
        
        PID:7208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        
        PID:11520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        14⤵
        Executes a command shell one-liner
        
        PID:6788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        
        PID:10772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        13⤵
        
        PID:6420
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        
        PID:10904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        12⤵
        
        PID:5184
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        Kills process with taskkill
        
        PID:11736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        11⤵
        
        PID:5848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        
        PID:11728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        10⤵
        
        PID:5568
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        
        PID:10740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        9⤵
        
        PID:5312
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        
        PID:9672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        8⤵
        
        PID:3436
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        
        PID:10072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        7⤵
        Executes a command shell one-liner
        
        PID:3896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        8⤵
        
        PID:9432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        6⤵
        
        PID:3492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        7⤵
        
        PID:7816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
        5⤵
        
        PID:4472
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        6⤵
        
        PID:7448
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:20068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
      4⤵
      PID:3268
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        
        PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe & start explorer.exe"
    3⤵
    PID:3992
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:8380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_bz2.pyd
Size 84KB
SHA256 37cbaeff9be4494f682eafe4adb642178f9c7277d4cda9ec343cfc06849a263b
MD5 e3035138d1373e96e169e4c446b18e76
SHA1 101cd23556bc0a8c4728460c4bf0bd15fa0f3d7e
SHA512 935bafffde5f9e90f866533c863087fdca6df0e176906aad2c7fef4325df2eeb4ae2bc4eaa24096425679c2196feef48c0061392fd5b7a13d5957d37f93f4c47
SSDEEP 1536:8ssutY90GtePwhFjKjBSnLYK9EJG8jKMi+gIP3VQyjKdLi92t+fIzoG4Zbu:btw0GtePwbuByY2SxuMi+gIP3V2t/EC
TLSH
T109835C52AB7416BAF22B917816B043A3F730BB65172057EFB2C485552F13FD1AE303A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_ctypes.pyd
Size 139KB
SHA256 746cf693e04ceb5f5468cbd7d1cbd535403693e421dad0d34ff77a25b171bc20
MD5 d9613a6cc7eeab428957c666ecdcb8b3
SHA1 ed9ac7f748a1000ba886490f3477d97602f4f4d2
SHA512 c70af6817bd4053a251364d436470e4f18d6637fd8684a3a9ab0e8da060f7f5aad06b1ab90d35ed7f8ccb4cbc4b755361d7b8e56357dc8e2e7c7bb688be643a4
SSDEEP 3072:a+oHacqjRXPAuvs2FisZiY70m6FrpOEOq57ze3zxOE8pN3z3xYZjEcIPGP+JE:5nY6i6QreM7zOgT3kjEk
TLSH
T141E35B4B739800A6DB638178C5B39A47EBB1F4516B2053CF0164C99A2F637E2AE3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_decimal.pyd
Size 320KB
SHA256 1fb076f03022f01c95c4422712053e0553127a324c3c3989acea8d600c931be5
MD5 2e7de5d7876aa89467779d1d7e98da1b
SHA1 6efd9d89214495d0903857235e4a9b600b2486fd
SHA512 103b931370b5ed571d5ac7dc505fc7c0b7b2de9b8117b2c20e6ea5368402bd924df1c3f4cf6b418aead3ee50bc9ecc7a277516bc1e57d80b47fa77eed2fea44d
SSDEEP 6144:Q7iOqbif0BLhCWEqs0v8E1CGHKWfMADx0Llc54oI:Wixifih9s0v0dFoI
TLSH
T1BA645A86D3590994EA37807989875A5BFBB2B8804360C6CF47A589973F933E3773A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_hashlib.pyd
Size 71KB
SHA256 7ef6760838a5496b47ec3f5a463672e27e23cb9477d20fcde3abf1f41cb3a62f
MD5 fd912ae98419075e627f70a2919a6127
SHA1 05ff86214ceb758cdff3c7dcacb512bca4579ce8
SHA512 2ef23e80a70049f7ee3f5b2f1742d16dfbfff445df5e27d827ef89ad671ba9855beef4d3cc23de336580c885184fd3be32082d0fbd1b05e4b70452acd3f7f684
SSDEEP 1536:GYa6mLMlYAiZkT303dFtFt1ABIL06YIPDIWyjKdLi9YfIERxO1:wMWAxIFtFt1AqL06YIPDIDJ
TLSH
T1EB636C56964800A1E96381B4C9E34F87E936F662271097DF63A8C18D2F237DBE37A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_lzma.pyd
Size 167KB
SHA256 cfe42690aac2065f94d9e7df8cf53c523fdce787b9cb1593abe0190ae1d5891b
MD5 008e6abc565ed25cfadbdf61cf81dc3e
SHA1 6288e84fa1436348cf615550283ccedc5ef0dd25
SHA512 401f346436ef67a980e8e8dcd8e4d303374129000a174fe027d535775ba45cc0fba7f4ef1fc24b1d7a82fa7076d7bf91e4f6a0753c04e466d7e64910818e1ad3
SSDEEP 3072:3sRr+8GAgJ6wLtOGq8YQpsrL0znf19mNoDx5PExmP+gIPI1Ug:3sRr+MgJ6wB67Q0qtYODvE4Wk
TLSH
T12BF32991B258F0D6F3328C34CA964F63E6F97805432092DB018D977D6A2FBE59A76313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_multiprocessing.pyd
Size 37KB
SHA256 f095e3798df2f63c3087871d3355696135725ad5b55df094c34ad42a3c355b7c
MD5 c23113b6eaad83eddf573f3df52a1061
SHA1 a38fb4580297d1663fda9651b132b274587060d2
SHA512 f51a5b7d1393d69c6cb72bce36197833dfdb81d5765c45b9ac581dc60a2464c63db2f4f726d9ba69761a66d4cf70454fb07bcabe7fde1c184ffae21d7c33f56c
SSDEEP 768:36RLiOD5KTjuv1FFN0Ia/62CXKIIP7tCCyjKdAPuBL2Ip4jTxf1mlLbkYwl:KRL/KTYFNRa/62C6IIP7tCCyjKdLi9hB
TLSH
T148036D8666680067F933963585E2DE4BF939F3971B2186DF3095D2CD0E377C2A33A249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_queue.pyd
Size 35KB
SHA256 ce5c36c17242234186180d93fc1299a4dbe2f2e049bba6da3dcacad29cbac1ce
MD5 c247227084e4260716daed18906db966
SHA1 059c77cf937b882bcf474cbaa586865ab9460976
SHA512 747344d0858bcd7c90eceb879f8ac05bf1f84b0328fdb612c50644f871f45a0fe769a8a71af47b1404102fcf31fb54a91841d734b3986dd3602db7372114aa19
SSDEEP 768:FHWYKYCLzytdi5kofcIPRUAAlyjKdAPuBL2Ip4E/QTxf1mlLbkvPwu:F2YCL0di5ZcIPRUAcyjKdLi9E/8fIEnv
TLSH
T120F28FCAA65801E7FA778570C6E6CE83F875F7A3571183DB3068814D1E237C1A77A268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_socket.pyd
Size 86KB
SHA256 a8a469df1c4fadfad6a72d379e1af7591e552c9c24aba0ca3dfd8e2ba8bfdb91
MD5 2466924026b846b9dd3049a55405972f
SHA1 e5144b9c4e33355b36b80c010c877aa3f4fb66f5
SHA512 a23ae0c389785b480c02fa91c71743a7f4f267c8740b3edbd5a7fd628ee558460cf47067df4cd755fe294e85e0a8bb32483cad9c3101cd6cc0e6b330b09e33eb
SSDEEP 1536:ZTFMxL96MDsyiuK7Oc4M0ypYHiXA+6Xwwzckrf4PcktcIPGwfHyjKdLi9kfIE14:TelsGK6c4HypYHiXAzXwwz1D4EktcIPo
TLSH
T1ED835901A6A041F6EB729175C2638E63FF74B4C11394A7DF1466C65A1F333C2BE3AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_ssl.pyd
Size 192KB
SHA256 6ed057907738947eef7e78076d3b2b137b7d1b8c925d19b1b04b520614d23a7a
MD5 b31776fb765e479449ad081053669bc5
SHA1 97e15b46d2040e144c299ad449c34251a37c881b
SHA512 6f9b64fbbf87d8bc47d69dde2e45e20f4a87d8280aba1541858c9eda4d36743933c548c8e90d029179b6e091cca2fc0ab5e8c04f716c809daf5976bbd0ab40db
SSDEEP 3072:Ugci4V8O3dTrGPMLfIh7ifsjjK6pGs5kL2L+1kTPzXClity1Q5MFe82Iu5tyFjU1:Mi4VNt3ACIh7ifsjjsFp682GA
TLSH
T1EB145947B1945AB7D912E5F9C6234543FBB4F004331297DF48C6D9A20E03787AE7AAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\_zstd.pyd
Size 494KB
SHA256 229e2029d167490a4fc95def7ca1670aee358a732cae13285478e74b8ce2f1d1
MD5 4823a9040f63d6cc4cc158d01001f590
SHA1 c88639308123386222924839700f5221a07f351b
SHA512 c4235f15f7d2a060f016a734e32a6e71995618e60fabf689538995028e9d45e026b70b62427d61914c458b7d24c1927d38115ae87d5f3b2f6605ed54b3aba882
SSDEEP 12288:j8c6M6EDdQw0MiO+sDwUZRkB22RvWYHDEg5BCl9VEHS:j8DMn0tWRkBFuYHDtS
TLSH
T1E2B49E43F25943ECD437C4B4CA5A9613FBB6B84A2214525793A5DFA83F03B31DB2A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\base_library.zip
Size 1.4MB
SHA256 bea425dd27eb5490ef02afb7007400d05684c894a83b72dec6f878bc6339a352
MD5 6c3d76e08fe52cf32e31c454a0f7d1a9
SHA1 98ce39fd2eede5c187e7684832e564b5088fd630
SHA512 9c197dd9efd4ed2dcb9407fc3547ba9919fd275f92fac24576824e3ef4f61081aa41d24c785b5922e3b5004d3f9ebdf9b8022a507533adb61668c908e24e204e
SSDEEP 24576:i7Z7QJcolxeGXP2m25aW62ZTmVdAFwXe9z8sgF:OmvcWAmVOFce9z8sI
TLSH
T163653AE6749239D7FF48F37F4037AE0C2BA95111EE04E6477C9949B82FAE6901F58188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\libcrypto-3.dll
Size 5.7MB
SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
MD5 b306c000f2b892736f0e66d265c61876
SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
TLSH
T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\libssl-3.dll
Size 1.2MB
SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
MD5 5aaafa642930cc5ca5e7b6aa7a07f0a6
SHA1 3500c90b532ac1eb39b421a03bab59ad8149e809
SHA512 07cc0de051cbc1ec13d5648e708be08d12a79dbc0f2df48eeadc82a26cde638d86e2bbb6f71897de0217e29d5e69711632da9076f509eb935e170d35192cdef5
SSDEEP 24576:PKPVy3rUry/1n0EahtEf0O29YlFqW9Rg5aYsG:PKty3rZ1npkdeRg5aYsG
TLSH
T1D0556B6AB7B811ADD5B7D17CC6938B17E2B2B0002360A7EF066087791F23BD6167E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\pyexpat.pyd
Size 230KB
SHA256 939ad5e268d3f6f365b900570a9a8118b4fef6e2c6456d4da0949dbc8fbe7788
MD5 16f2a8d1d114c0c651cbb2e3d5808d83
SHA1 0e681b5f3b0aab5db8605ba1488724135761b508
SHA512 2ef41998a4126db4f440b1662a5b45a20311f0822a7b85df5e258995710618a31020133122f056f77a278065321725989bbb204a72a86813deee48344fd1155a
SSDEEP 6144:yompl3nuJMgKR9BClWWYZnQwG2GUQkT+FFC95M4K:CyKR9BCc5lQwwUvhK
TLSH
T1B6347D56B2A5C5E5EC538038C9934A07EB72FD651312A6CF27808A7E9F277D7173A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\python315.dll
Size 7.5MB
SHA256 ca4f7b4823ca187f4a6483fba9f21804390a183b783ee2bf9b5ab75d98f62c3b
MD5 3a9d7ffd3b407879f13fee566e523e62
SHA1 8e4b7dd597608f8e421995fd980452eb199731be
SHA512 de27b06ca9ad246bd10f9d6921f7bd4ea53558fc889f59111ad9a7072302f055ca8f9ed55b7dba5b850d3e5fe47de8c35d9eadb422a29c8590966511d4bd1444
SSDEEP 98304:3RFyy6m+gxchUIywFr8dyGL2MOa5FuEhv5HDMiEp0+J:3RFr6thUIyw18dyNMOOyiF+J
TLSH
T1D5867B3A73A511A4D87BC036C5434647EBB1BC10AB20D2CB52547A9A2F337E35BFA725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\select.pyd
Size 32KB
SHA256 63b91cac778f46e3e01545b3f358014442dedc105d99ddfece21933399edcf7b
MD5 6bd196c82905a50468dc4f5b7c58fb1a
SHA1 e29f89831abd4a97c69ae131741706c02164f7ad
SHA512 74f67c42b7296019de4cc001ab34c5ba692477d6bafa61ba21d65fefcb48ea08cd4eb3994644aab5ac7435661f32c1f54fde849f90b872797892f97b0ed78b7a
SSDEEP 768:jYOLuWIUtqE+BZJ5AFypxcIPRGAyjKdAPuBL2Ip46Txf1mlLbk2w4:sOLuTUF432FyXcIPRGAyjKdLi9yfIE25
TLSH
T10DE26DCA6B684053EA63867286F5CE43F935B7E35B2086DB30A9814D1E677C1B73A214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010142\unicodedata.pyd
Size 735KB
SHA256 2a0975f5b5198771c80b2032e2b5ea4b95a0298a5096e014cb88898428618b59
MD5 31034475cbb535647b07fa8d50b99122
SHA1 f9c0811715020e76a0901ca69702cbb9dfabbea1
SHA512 d8158e6f2c6729e605ccd97f5b8dcb3a497b97cae90b79042dd7056e986f7fa477cc4fb5cb03baef4d339fa97a8606160ca2fec4989d2e9d33df00ae90de28ed
SSDEEP 12288:szYAoZcdJhcHnMAURE6+fvhI4DWBDEZqMxt5xg:szYA/dsHXjvhADEZl5xg
TLSH
T1A8F4E45FB4840A03D62DCAB833A37576D06FF77EDE06662B36D44010A4072E9B9EF619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/12076-123-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

memory/13004-125-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

memory/14168-118-0x00007FF6CF070000-0x00007FF6CF0D2000-memory.dmp

Download

memory/19420-104-0x00007FFB025A0000-0x00007FFB027A9000-memory.dmp

Download

memory/22604-107-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

memory/24344-102-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

memory/27444-114-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

memory/27644-106-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

memory/28092-115-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

memory/32404-108-0x00007FF6CF070000-0x00007FF6CF0D2000-memory.dmp

Download

memory/50712-116-0x00007FF772400000-0x00007FF77246C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads