dcrat | f90400299ddff091af50c2a7c46454e35e6a4b01a876096a0e180d1aabb68e9c

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Crtnet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	services.exe

Executes dropped EXE 2 IoCs

pid	Process
4560	Crtnet.exe
1804	services.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\886983d96e3d3e	Crtnet.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\ee2ad38f3d4382	Crtnet.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\088424020bedd6	Crtnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\1077685f5e0d39	Crtnet.exe
File created	C:\Program Files\dotnet\swidtag\f3b6ecef712a24	Crtnet.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\cmd.exe	Crtnet.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\services.exe	Crtnet.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\wininit.exe	Crtnet.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\56085415360792	Crtnet.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\conhost.exe	Crtnet.exe
File created	C:\Program Files\dotnet\swidtag\spoolsv.exe	Crtnet.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\c5b4cb5e9653cc	Crtnet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\5940a34987c991	Crtnet.exe
File created	C:\Program Files\Uninstall Information\csrss.exe	Crtnet.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Registry.exe	Crtnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Crtnet.exe	Crtnet.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\ebf1f9fa8afd6d	Crtnet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe	Crtnet.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\es-ES\WaaSMedicAgent.exe	Crtnet.exe
File created	C:\Windows\es-ES\c82b8037eab33d	Crtnet.exe
File created	C:\Windows\tracing\dllhost.exe	Crtnet.exe
File created	C:\Windows\tracing\5940a34987c991	Crtnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2124	schtasks.exe
3372	schtasks.exe
4472	schtasks.exe
2720	schtasks.exe
2532	schtasks.exe
2908	schtasks.exe
4960	schtasks.exe
1004	schtasks.exe
4880	schtasks.exe
1700	schtasks.exe
636	schtasks.exe
3144	schtasks.exe
4688	schtasks.exe
3284	schtasks.exe
1984	schtasks.exe
2516	schtasks.exe
3024	schtasks.exe
4584	schtasks.exe
4392	schtasks.exe
3176	schtasks.exe
2688	schtasks.exe
4464	schtasks.exe
3488	schtasks.exe
4612	schtasks.exe
4380	schtasks.exe
2172	schtasks.exe
4612	schtasks.exe
2212	schtasks.exe
1208	schtasks.exe
2512	schtasks.exe
4456	schtasks.exe
2600	schtasks.exe
4576	schtasks.exe
2360	schtasks.exe
5032	schtasks.exe
4996	schtasks.exe
2608	schtasks.exe
4204	schtasks.exe
4912	schtasks.exe
5072	schtasks.exe
4428	schtasks.exe
888	schtasks.exe
3380	schtasks.exe
5060	schtasks.exe
3772	schtasks.exe
2028	schtasks.exe
992	schtasks.exe
876	schtasks.exe
1472	schtasks.exe
3380	schtasks.exe
2704	schtasks.exe
1804	schtasks.exe
2696	schtasks.exe
800	schtasks.exe
1316	schtasks.exe
2904	schtasks.exe
5016	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	Crtnet.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
4560	Crtnet.exe
1804	services.exe
1804	services.exe
1804	services.exe
1804	services.exe
1804	services.exe
1804	services.exe
1804	services.exe
1804	services.exe
1804	services.exe
1804	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	services.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	Crtnet.exe
Token: SeDebugPrivilege	1804	services.exe
Token: SeCreateGlobalPrivilege	10676	dwm.exe
Token: SeChangeNotifyPrivilege	10676	dwm.exe
Token: 33	10676	dwm.exe
Token: SeIncBasePriorityPrivilege	10676	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2800	2028	DCRatBuild.exe	90
PID 2028 wrote to memory of 2800	2028	DCRatBuild.exe	90
PID 2028 wrote to memory of 2800	2028	DCRatBuild.exe	90
PID 2800 wrote to memory of 4624	2800	WScript.exe	101
PID 2800 wrote to memory of 4624	2800	WScript.exe	101
PID 2800 wrote to memory of 4624	2800	WScript.exe	101
PID 4624 wrote to memory of 4560	4624	cmd.exe	103
PID 4624 wrote to memory of 4560	4624	cmd.exe	103
PID 4560 wrote to memory of 2440	4560	Crtnet.exe	161
PID 4560 wrote to memory of 2440	4560	Crtnet.exe	161
PID 2440 wrote to memory of 4960	2440	cmd.exe	164
PID 2440 wrote to memory of 4960	2440	cmd.exe	164
PID 2440 wrote to memory of 1804	2440	cmd.exe	168
PID 2440 wrote to memory of 1804	2440	cmd.exe	168
PID 1804 wrote to memory of 660	1804	services.exe	171
PID 1804 wrote to memory of 660	1804	services.exe	171
PID 1804 wrote to memory of 4656	1804	services.exe	173
PID 1804 wrote to memory of 4656	1804	services.exe	173
PID 1804 wrote to memory of 232	1804	services.exe	175
PID 1804 wrote to memory of 232	1804	services.exe	175
PID 1804 wrote to memory of 2340	1804	services.exe	177
PID 1804 wrote to memory of 2340	1804	services.exe	177
PID 660 wrote to memory of 4488	660	cmd.exe	178
PID 660 wrote to memory of 4488	660	cmd.exe	178
PID 1804 wrote to memory of 2860	1804	services.exe	180
PID 1804 wrote to memory of 2860	1804	services.exe	180
PID 4656 wrote to memory of 2232	4656	cmd.exe	182
PID 4656 wrote to memory of 2232	4656	cmd.exe	182
PID 1804 wrote to memory of 636	1804	services.exe	183
PID 1804 wrote to memory of 636	1804	services.exe	183
PID 1804 wrote to memory of 3244	1804	services.exe	185
PID 1804 wrote to memory of 3244	1804	services.exe	185
PID 2340 wrote to memory of 1476	2340	cmd.exe	187
PID 2340 wrote to memory of 1476	2340	cmd.exe	187
PID 232 wrote to memory of 4292	232	cmd.exe	188
PID 232 wrote to memory of 4292	232	cmd.exe	188
PID 1804 wrote to memory of 2072	1804	services.exe	189
PID 1804 wrote to memory of 2072	1804	services.exe	189
PID 1804 wrote to memory of 4332	1804	services.exe	191
PID 1804 wrote to memory of 4332	1804	services.exe	191
PID 1804 wrote to memory of 1892	1804	services.exe	193
PID 1804 wrote to memory of 1892	1804	services.exe	193
PID 1804 wrote to memory of 2356	1804	services.exe	195
PID 1804 wrote to memory of 2356	1804	services.exe	195
PID 2860 wrote to memory of 3576	2860	cmd.exe	196
PID 2860 wrote to memory of 3576	2860	cmd.exe	196
PID 636 wrote to memory of 4260	636	cmd.exe	198
PID 636 wrote to memory of 4260	636	cmd.exe	198
PID 1804 wrote to memory of 2940	1804	services.exe	199
PID 1804 wrote to memory of 2940	1804	services.exe	199
PID 1804 wrote to memory of 1228	1804	services.exe	201
PID 1804 wrote to memory of 1228	1804	services.exe	201
PID 1804 wrote to memory of 4380	1804	services.exe	203
PID 1804 wrote to memory of 4380	1804	services.exe	203
PID 1804 wrote to memory of 3052	1804	services.exe	206
PID 1804 wrote to memory of 3052	1804	services.exe	206
PID 2072 wrote to memory of 2536	2072	cmd.exe	205
PID 2072 wrote to memory of 2536	2072	cmd.exe	205
PID 3244 wrote to memory of 4392	3244	cmd.exe	208
PID 3244 wrote to memory of 4392	3244	cmd.exe	208
PID 1804 wrote to memory of 5172	1804	services.exe	209
PID 1804 wrote to memory of 5172	1804	services.exe	209
PID 4332 wrote to memory of 5180	4332	cmd.exe	210
PID 4332 wrote to memory of 5180	4332	cmd.exe	210

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Fontruntime\2jb5ajJYZ.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Fontruntime\fVpW1lRUqKPT.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Fontruntime\Crtnet.exe
      "C:\Fontruntime\Crtnet.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f3KKfBNtYX.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2440
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4960
      - C:\Program Files\Microsoft Office 15\ClientX64\services.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\services.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:660
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:4488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:2232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:4292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:1476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:3576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:4260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:4392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:2536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:1892
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:2356
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:2940
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:1228
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:4380
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:3052
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5172
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5260
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5356
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5440
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5496
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5564
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:5676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5644
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5736
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5768
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5840
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5920
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6008
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6084
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:2032
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:4812
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6220
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6272
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6324
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6412
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6496
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6576
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6636
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6724
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6784
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6880
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:6740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6980
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7052
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:5860
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:6592
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7212
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7268
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7344
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7408
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:4936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7476
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7524
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7624
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7680
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7772
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7888
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7952
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8040
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8116
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8152
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:3348
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:3556
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8168
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8248
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8304
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8396
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8468
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8548
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8648
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8736
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8828
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8892
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:1656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:8988
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9036
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9120
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9204
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:1468
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:9988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9232
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:7452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9296
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9376
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:8436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9432
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9528
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9576
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9644
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9696
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9756
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9880
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9924
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10008
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10096
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10180
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:7844
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9720
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:9276
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10260
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10348
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10420
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10460
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:10952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10516
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10608
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10712
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10772
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10844
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10916
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11000
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11084
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11252
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10280
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11324
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11380
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11436
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:11912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11520
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11572
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11620
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11688
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11756
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11824
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11884
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11972
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12088
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12144
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12212
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12276
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:11592
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:10484
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12304
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:12696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12344
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12404
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12496
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12644
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12764
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12856
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12940
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13012
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13100
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13148
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13204
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12236
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12436
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12124
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:12368
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:13860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13544
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13608
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13664
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13728
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:14072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:14264
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:14324
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:13688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:14360
        
        C:\Windows\system32\notepad.exe
        
        notepad.exe
        8⤵
        
        PID:14984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:14400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwXVi07PWy.bat" "
        7⤵
        
        PID:14432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\es-ES\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CrtnetC" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Crtnet.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Crtnet" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Crtnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CrtnetC" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Crtnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Saved Games\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\SendTo\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\SendTo\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\swidtag\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\swidtag\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\tracing\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Fontruntime\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Fontruntime\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Fontruntime\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Fontruntime\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Fontruntime\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Fontruntime\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3976,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:2280

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery