68d7b7ab339e4b268183c2ebad8e3f6672d411892e95acd786124902b1649238

Analysis

max time kernel
2s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Agent.newukx.exe
Size 32KB
Sample261015-22cy2aew2m
SHA256 68d7b7ab339e4b268183c2ebad8e3f6672d411892e95acd786124902b1649238
MD5 31bb492d3b229eb6b09e8904fac42fe9
SHA1 4f27b1d7a4922be1548fc3d1c268c21e00b26c04
SHA512 5444021e8945aaa99f0f53149f541ef9ec6647badf00c26a66e70229b4d97bd5e47a46a402df5ac0a23cc2834aeeb4d978a28b520ab4a08584f21049ae1a3f08
SSDEEP 768:cEQI94Yfl2YdqdH0vl1LlXDJ+Iv/74Keqhd40Y6W9U+2g:cEQIOxD4l1LlXDH7p4/6W9J
TLSH
T15BE2F158D7B18C22C582127D6BE1400117EDFFE071390BC7CE6CA9DEAF7299D689D40A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
6044	winlog.exe
4624	winlog.exe
684	winlog.exe
1980	winlog.exe
828	winlog.exe
5640	winlog.exe
4616	winlog.exe
4328	winlog.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winlog.exe	jaffacakes118_Trojan.Win32.Agent.newukx.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe
File created	C:\Windows\SysWOW64\winlog.exe	winlog.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\melt.bat	winlog.exe
File opened for modification	C:\Windows\melt.bat	winlog.exe
File opened for modification	C:\Windows\melt.bat	winlog.exe
File opened for modification	C:\Windows\melt.bat	jaffacakes118_Trojan.Win32.Agent.newukx.exe
File opened for modification	C:\Windows\melt.bat	winlog.exe
File opened for modification	C:\Windows\melt.bat	winlog.exe
File opened for modification	C:\Windows\melt.bat	winlog.exe
File opened for modification	C:\Windows\melt.bat	winlog.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7752	cmd.exe
13188	cmd.exe
8420	cmd.exe
12976	cmd.exe
1104	cmd.exe
7304	cmd.exe
7856	cmd.exe
9412	cmd.exe
3524	cmd.exe
4080	cmd.exe
6204	cmd.exe
920	cmd.exe
10488	cmd.exe
8188	cmd.exe
10124	cmd.exe
11836	cmd.exe
704	cmd.exe
6700	cmd.exe
10492	cmd.exe
2904	cmd.exe
3252	cmd.exe
5692	cmd.exe
6352	cmd.exe
8032	cmd.exe
9724	cmd.exe
11028	cmd.exe
4876	cmd.exe
11220	cmd.exe
7040	cmd.exe
10664	cmd.exe
2080	cmd.exe
6236	cmd.exe
11100	cmd.exe
11560	cmd.exe
4676	cmd.exe
2520	cmd.exe
8160	cmd.exe
10368	cmd.exe
1564	cmd.exe
12796	cmd.exe
5392	cmd.exe
1944	cmd.exe
7388	cmd.exe
9612	cmd.exe
11744	cmd.exe
11932	cmd.exe
6220	cmd.exe
8528	cmd.exe
10708	cmd.exe
7508	cmd.exe
7724	cmd.exe
10348	cmd.exe
9716	cmd.exe
6776	cmd.exe
11084	cmd.exe
9052	cmd.exe
3932	cmd.exe
3424	cmd.exe
4424	cmd.exe
6424	cmd.exe
10616	cmd.exe
9084	cmd.exe
8080	cmd.exe
8792	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Agent.newukx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
6120	jaffacakes118_Trojan.Win32.Agent.newukx.exe
6120	jaffacakes118_Trojan.Win32.Agent.newukx.exe
6044	winlog.exe
6044	winlog.exe
4624	winlog.exe
4624	winlog.exe
684	winlog.exe
684	winlog.exe
1980	winlog.exe
1980	winlog.exe
828	winlog.exe
828	winlog.exe
5640	winlog.exe
5640	winlog.exe
4616	winlog.exe
4616	winlog.exe
4328	winlog.exe
4328	winlog.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	6120	jaffacakes118_Trojan.Win32.Agent.newukx.exe
Token: SeDebugPrivilege	6120	jaffacakes118_Trojan.Win32.Agent.newukx.exe
Token: SeDebugPrivilege	6044	winlog.exe
Token: SeDebugPrivilege	6044	winlog.exe
Token: SeDebugPrivilege	4624	winlog.exe
Token: SeDebugPrivilege	4624	winlog.exe
Token: SeDebugPrivilege	684	winlog.exe
Token: SeDebugPrivilege	684	winlog.exe
Token: SeDebugPrivilege	1980	winlog.exe
Token: SeDebugPrivilege	1980	winlog.exe
Token: SeDebugPrivilege	828	winlog.exe
Token: SeDebugPrivilege	828	winlog.exe
Token: SeDebugPrivilege	5640	winlog.exe
Token: SeDebugPrivilege	5640	winlog.exe
Token: SeDebugPrivilege	4616	winlog.exe
Token: SeDebugPrivilege	4616	winlog.exe
Token: SeDebugPrivilege	4328	winlog.exe
Token: SeDebugPrivilege	4328	winlog.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 6044	6120	jaffacakes118_Trojan.Win32.Agent.newukx.exe	89
PID 6120 wrote to memory of 724	6120	jaffacakes118_Trojan.Win32.Agent.newukx.exe	90
PID 6044 wrote to memory of 4624	6044	winlog.exe	92
PID 6044 wrote to memory of 1548	6044	winlog.exe	93
PID 4624 wrote to memory of 684	4624	winlog.exe	95
PID 4624 wrote to memory of 5916	4624	winlog.exe	96
PID 684 wrote to memory of 1980	684	winlog.exe	98
PID 684 wrote to memory of 2916	684	winlog.exe	99
PID 1980 wrote to memory of 828	1980	winlog.exe	101
PID 1980 wrote to memory of 2176	1980	winlog.exe	102
PID 828 wrote to memory of 5640	828	winlog.exe	104
PID 828 wrote to memory of 1108	828	winlog.exe	105
PID 5640 wrote to memory of 4616	5640	winlog.exe	107
PID 5640 wrote to memory of 1684	5640	winlog.exe	108
PID 4616 wrote to memory of 4328	4616	winlog.exe	110

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.newukx.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.newukx.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\SysWOW64\winlog.exe
  "C:\Windows\system32\winlog.exe" /i
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\SysWOW64\winlog.exe
    "C:\Windows\system32\winlog.exe" /i
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\winlog.exe
      "C:\Windows\system32\winlog.exe" /i
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        10⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        11⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        12⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        13⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        14⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        15⤵
        
        PID:580
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        16⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        17⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        18⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        19⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        20⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        21⤵
        
        PID:432
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        22⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        23⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        24⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        25⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        26⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        27⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        28⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        29⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        30⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        31⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        32⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        33⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        34⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        35⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        36⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        37⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        38⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        39⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        40⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        41⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        42⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        43⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        44⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        45⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        46⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        47⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        48⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        49⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        50⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        51⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        52⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        53⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        54⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        55⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        56⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        57⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        58⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        59⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        60⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        61⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        62⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        63⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        64⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        65⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        66⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        67⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        68⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        69⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        70⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        71⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        72⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        73⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        74⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        75⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        76⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        77⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        78⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        79⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        80⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        81⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        82⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        83⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        84⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        85⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        86⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        87⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        88⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        89⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        90⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        91⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        92⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        93⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        94⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        95⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        96⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        97⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        98⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        99⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        100⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        101⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        102⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        103⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        104⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        105⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        106⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        107⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        108⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        109⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        110⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        111⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        112⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        113⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        114⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        115⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        116⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        117⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        118⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        119⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        120⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        121⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        122⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        123⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        124⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        125⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        126⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        127⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        128⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        129⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        130⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        131⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        132⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        133⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        134⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        135⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        136⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        137⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        138⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        139⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        140⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        141⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        142⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        143⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        144⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        145⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        146⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        147⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        148⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        149⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        150⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        151⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        152⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        153⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        154⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        155⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        156⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        157⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        158⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        159⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        160⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        161⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        162⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        163⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        164⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        165⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        166⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        167⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        168⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        169⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        170⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        171⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        172⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        173⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        174⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        175⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        176⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        177⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        178⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        179⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        180⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        181⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        182⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        183⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        184⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        185⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        186⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        187⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        188⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        189⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        190⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        191⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        192⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        193⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        194⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        195⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        196⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        197⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        198⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        199⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        200⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        201⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        202⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        203⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        204⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        205⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        206⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        207⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        208⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        209⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        210⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        211⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        212⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        213⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        214⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        215⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        216⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        217⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        218⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        219⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        220⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        221⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        222⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        223⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        224⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        225⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        226⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        227⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        228⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        229⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        230⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        231⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        232⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        233⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        234⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        235⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        236⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        237⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        238⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        239⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        240⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        241⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        242⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        243⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        244⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        245⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        246⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        247⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        248⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        249⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        250⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        251⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        252⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        253⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        254⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        255⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        256⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        257⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        258⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        259⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        260⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        261⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        262⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        263⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        264⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        265⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        266⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        267⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        268⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        269⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        270⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        271⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        272⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        273⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\winlog.exe
        
        "C:\Windows\system32\winlog.exe" /i
        274⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        274⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        273⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        272⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        271⤵
        Executes a command shell one-liner
        
        PID:13188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        270⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        269⤵
        Executes a command shell one-liner
        
        PID:12976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        268⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        267⤵
        Executes a command shell one-liner
        
        PID:12796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        266⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        265⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        264⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        263⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        262⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        261⤵
        Executes a command shell one-liner
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        260⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        259⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        258⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        257⤵
        Executes a command shell one-liner
        
        PID:10368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        256⤵
        Executes a command shell one-liner
        
        PID:11028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        255⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        254⤵
        Executes a command shell one-liner
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        253⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        252⤵
        Executes a command shell one-liner
        
        PID:10124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        251⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        250⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        249⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        248⤵
        Executes a command shell one-liner
        
        PID:11084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        247⤵
        Executes a command shell one-liner
        
        PID:10348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        246⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        245⤵
        Executes a command shell one-liner
        
        PID:9724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        244⤵
        Executes a command shell one-liner
        
        PID:10664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        243⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        242⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        241⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        240⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        239⤵
        Executes a command shell one-liner
        
        PID:7752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        238⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        237⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        236⤵
        Executes a command shell one-liner
        
        PID:8032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        235⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        234⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        233⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        232⤵
        Executes a command shell one-liner
        
        PID:8188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        231⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        230⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        229⤵
        Executes a command shell one-liner
        
        PID:7724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        228⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        227⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        226⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        225⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        224⤵
        Executes a command shell one-liner
        
        PID:9084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        223⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        222⤵
        Executes a command shell one-liner
        
        PID:11932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        221⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        220⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        219⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        218⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        217⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        216⤵
        Executes a command shell one-liner
        
        PID:7508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        215⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        214⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        213⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        212⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        211⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        210⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        209⤵
        Executes a command shell one-liner
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        208⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        207⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        206⤵
        Executes a command shell one-liner
        
        PID:6776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        205⤵
        Executes a command shell one-liner
        
        PID:6204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        204⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        203⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        202⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        201⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        200⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        199⤵
        Executes a command shell one-liner
        
        PID:11836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        198⤵
        Executes a command shell one-liner
        
        PID:11744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        197⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        196⤵
        Executes a command shell one-liner
        
        PID:11560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        195⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        194⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        193⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        192⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        191⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        190⤵
        Executes a command shell one-liner
        
        PID:7040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        189⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        188⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        187⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        186⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        185⤵
        Executes a command shell one-liner
        
        PID:6352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        184⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        183⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        182⤵
        Executes a command shell one-liner
        
        PID:3932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        181⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        180⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        179⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        178⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        177⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        176⤵
        
        PID:928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        175⤵
        Executes a command shell one-liner
        
        PID:3524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        174⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        173⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        172⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        171⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        170⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        169⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        168⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        167⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        166⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        165⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        164⤵
        Executes a command shell one-liner
        
        PID:10488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        163⤵
        Executes a command shell one-liner
        
        PID:11220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        162⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        161⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        160⤵
        Executes a command shell one-liner
        
        PID:10708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        159⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        158⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        157⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        156⤵
        Executes a command shell one-liner
        
        PID:11100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        155⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        154⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        153⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        152⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        151⤵
        Executes a command shell one-liner
        
        PID:10616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        150⤵
        Executes a command shell one-liner
        
        PID:10492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        149⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        148⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        147⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        146⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        145⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        144⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        143⤵
        Executes a command shell one-liner
        
        PID:9716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        142⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        141⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        140⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        139⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        138⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        137⤵
        Executes a command shell one-liner
        
        PID:9612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        136⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        135⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        134⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        133⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        132⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        131⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        130⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        129⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        128⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        127⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        126⤵
        Executes a command shell one-liner
        
        PID:9412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        125⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        124⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        123⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        122⤵
        Executes a command shell one-liner
        
        PID:9052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        121⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        120⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        119⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        118⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        117⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        116⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        115⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        114⤵
        Executes a command shell one-liner
        
        PID:8792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        113⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        112⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        111⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        110⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        109⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        108⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        107⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        106⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        105⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        104⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        103⤵
        Executes a command shell one-liner
        
        PID:8528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        102⤵
        Executes a command shell one-liner
        
        PID:8420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        101⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        100⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        99⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        98⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        97⤵
        Executes a command shell one-liner
        
        PID:7856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        96⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        95⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        94⤵
        Executes a command shell one-liner
        
        PID:8080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        93⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        92⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        91⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        90⤵
        Executes a command shell one-liner
        
        PID:8160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        89⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        88⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        87⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        86⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        85⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        84⤵
        Executes a command shell one-liner
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        83⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        82⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        81⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        80⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        79⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        78⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        77⤵
        Executes a command shell one-liner
        
        PID:7388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        76⤵
        Executes a command shell one-liner
        
        PID:7304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        75⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        74⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        73⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        72⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        71⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        70⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        69⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        68⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        67⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        66⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        65⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        64⤵
        Executes a command shell one-liner
        
        PID:6220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        63⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        62⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        61⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        60⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        59⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        58⤵
        Executes a command shell one-liner
        
        PID:6424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        57⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        56⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        55⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        54⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        53⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        52⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        51⤵
        Executes a command shell one-liner
        
        PID:6700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        50⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        49⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        48⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        47⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        46⤵
        Executes a command shell one-liner
        
        PID:6236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        45⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        44⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        43⤵
        Executes a command shell one-liner
        
        PID:4424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        42⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        41⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        40⤵
        Executes a command shell one-liner
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        39⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        38⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        37⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        36⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        35⤵
        
        PID:240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        34⤵
        Executes a command shell one-liner
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        33⤵
        Executes a command shell one-liner
        
        PID:1944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        32⤵
        Executes a command shell one-liner
        
        PID:4080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        31⤵
        Executes a command shell one-liner
        
        PID:4876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        30⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        29⤵
        Executes a command shell one-liner
        
        PID:5392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        28⤵
        Executes a command shell one-liner
        
        PID:3252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        27⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        26⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        25⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        24⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        23⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        22⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        21⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        20⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        19⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        18⤵
        Executes a command shell one-liner
        
        PID:704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        17⤵
        Executes a command shell one-liner
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        16⤵
        Executes a command shell one-liner
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        15⤵
        Executes a command shell one-liner
        
        PID:2520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        14⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        13⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        12⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        11⤵
        
        PID:124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        10⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        9⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1108
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\melt.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlog.exe

Path C:\Windows\SysWOW64\winlog.exe
Size 32KB
SHA256 68d7b7ab339e4b268183c2ebad8e3f6672d411892e95acd786124902b1649238
MD5 31bb492d3b229eb6b09e8904fac42fe9
SHA1 4f27b1d7a4922be1548fc3d1c268c21e00b26c04
SHA512 5444021e8945aaa99f0f53149f541ef9ec6647badf00c26a66e70229b4d97bd5e47a46a402df5ac0a23cc2834aeeb4d978a28b520ab4a08584f21049ae1a3f08
SSDEEP 768:cEQI94Yfl2YdqdH0vl1LlXDJ+Iv/74Keqhd40Y6W9U+2g:cEQIOxD4l1LlXDH7p4/6W9J
TLSH
T15BE2F158D7B18C22C582127D6BE1400117EDFFE071390BC7CE6CA9DEAF7299D689D40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

melt.bat

Path C:\Windows\melt.bat
Size 228B
SHA256 1f348203fe9c178e772e2284ae91dbe7a7f7ce529db90d216828c2153397434e
MD5 6f3786c49a6a1cffd4d4226fd83a4fe3
SHA1 50a6240b3b2caa5cf456260043c3f44fdb4bb079
SHA512 572fcb24ba109fcc1c1bb7dc5496205f6b666470e915edf416eebc5dcfc780653567d3a724d95037acdf5b28c74899fbc66b302a161712c414b0c4952a3abfae
TLSH
T17AD092C8623241D1F060AC0B465E2A4AE60BA3E220042E3A213286A0E8A102B9E977C8
MD5 SHA1 SHA512 TLSH

Submit Download

melt.bat

Path C:\Windows\melt.bat
Size 228B
SHA256 740644b305dedd7a3b92058d9ab5bb7fd85f9104b3efa3f77f48aeec83e33cc6
MD5 32c2def858f94f327813d9d20a197128
SHA1 c9d8f7a4585b2c98c0fcd613be77dfcea85dc77e
SHA512 a533d2857d8a1fe3e3bbcf7ba3e782c95c8697f9f39458c5f5b350190ba114c76519bb22a567b371c09eea7180c0e857cc6269271d6ca64f2c0c1294f62ea3c9
TLSH
T15BD0A78991A286996400DC1F85795FCEE126099439443F351333C684D57001FFA83309
MD5 SHA1 SHA512 TLSH

Submit Download

memory/432-116-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/580-82-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/684-29-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/828-38-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1048-266-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1192-67-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1516-181-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1596-190-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1728-139-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1836-193-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1856-106-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1888-154-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1920-196-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1972-96-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1980-33-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2244-257-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2384-111-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2704-304-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2724-308-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2856-184-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2868-187-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3196-169-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3220-127-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3372-77-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3384-280-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3448-164-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3496-88-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3548-205-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4068-71-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4128-144-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4260-199-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4272-214-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4328-52-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4508-178-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4612-101-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4616-50-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4624-25-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4688-208-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4812-301-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4864-175-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4932-62-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5048-149-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5060-292-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5436-295-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5528-132-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5532-202-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5548-286-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5640-43-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5732-57-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5816-211-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5864-159-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6044-16-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6064-121-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6120-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6120-10-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6188-217-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6248-251-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6280-220-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6316-254-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6380-223-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6388-268-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6388-274-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6432-277-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6472-226-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6576-229-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6632-289-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6672-232-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6720-260-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6768-236-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6864-239-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6896-283-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6932-263-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6964-242-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7056-245-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7060-270-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7108-298-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7156-247-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7188-374-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7252-312-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7252-306-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7312-402-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7356-315-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7356-310-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7396-378-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7456-318-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7460-381-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7552-322-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7648-325-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7668-405-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7672-409-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7684-384-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7748-328-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7844-331-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7872-387-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7940-367-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/7960-399-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/8036-370-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/8076-396-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/8484-450-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/8492-569-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/8500-620-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/9012-476-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/9120-603-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/9376-981-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/12052-878-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/13252-1194-0x0000000000400000-0x000000000041C000-memory.dmp

Download