192a9a72f08373b3f16996fe7bbcddb9f7ef0a04cdb846220812a36e5bfd906b

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5712f8112f633c57a233814bb3923f9_JaffaCakes118.exe
Size

171KB
MD5

a5712f8112f633c57a233814bb3923f9
SHA1

275494bcf3cde45f981c9d93c373f7642811b260
SHA256

192a9a72f08373b3f16996fe7bbcddb9f7ef0a04cdb846220812a36e5bfd906b
SHA512

30186c153c1eb38994544a7bd4b1d4d28d93579a1783303f38888d54cdd79d0dd2992b44ec3b01c57765b260b92fce963d03333be0770d6c027b61341e373832
SSDEEP

3072:9bCX8UaFPmgRMNlPTGQQm6ytwZEsrYkK4d9hFap/QroKP:i898gWNlPTGQQm6agrd7HW4UK

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\msvce32.exe"	msvce32.exe

Executes dropped EXE 64 IoCs

pid	Process
4620	msvce32.exe
1004	msvce32.exe
1436	msvce32.exe
2056	msvce32.exe
3180	msvce32.exe
3992	msvce32.exe
5112	msvce32.exe
2828	msvce32.exe
3576	msvce32.exe
2640	msvce32.exe
3292	msvce32.exe
3956	msvce32.exe
4112	msvce32.exe
3628	msvce32.exe
2132	msvce32.exe
4964	msvce32.exe
1304	msvce32.exe
4880	msvce32.exe
2872	msvce32.exe
212	msvce32.exe
2564	msvce32.exe
4148	msvce32.exe
3140	msvce32.exe
4752	msvce32.exe
4980	msvce32.exe
3492	msvce32.exe
2000	msvce32.exe
3212	msvce32.exe
1224	msvce32.exe
1368	msvce32.exe
2684	msvce32.exe
4920	msvce32.exe
4216	msvce32.exe
1480	msvce32.exe
4512	msvce32.exe
264	msvce32.exe
448	msvce32.exe
4868	msvce32.exe
4364	msvce32.exe
4764	msvce32.exe
4708	msvce32.exe
4244	msvce32.exe
2544	msvce32.exe
3148	msvce32.exe
4400	msvce32.exe
3024	msvce32.exe
852	msvce32.exe
1544	msvce32.exe
3692	msvce32.exe
4676	msvce32.exe
1612	msvce32.exe
3964	msvce32.exe
4560	msvce32.exe
3052	msvce32.exe
4736	msvce32.exe
1556	msvce32.exe
2616	msvce32.exe
928	msvce32.exe
3544	msvce32.exe
3972	msvce32.exe
4720	msvce32.exe
4988	msvce32.exe
2548	msvce32.exe
668	msvce32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	a5712f8112f633c57a233814bb3923f9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File opened for modification	C:\Windows\SysWOW64\Deleteme.bat	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe
File created	C:\Windows\SysWOW64\msvce32.exe	msvce32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvce32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	11132	dwm.exe
Token: SeChangeNotifyPrivilege	11132	dwm.exe
Token: 33	11132	dwm.exe
Token: SeIncBasePriorityPrivilege	11132	dwm.exe
Token: SeShutdownPrivilege	11132	dwm.exe
Token: SeCreatePagefilePrivilege	11132	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4620	1476	a5712f8112f633c57a233814bb3923f9_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4620	1476	a5712f8112f633c57a233814bb3923f9_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4620	1476	a5712f8112f633c57a233814bb3923f9_JaffaCakes118.exe	84
PID 4620 wrote to memory of 1004	4620	msvce32.exe	85
PID 4620 wrote to memory of 1004	4620	msvce32.exe	85
PID 4620 wrote to memory of 1004	4620	msvce32.exe	85
PID 1004 wrote to memory of 1436	1004	msvce32.exe	86
PID 1004 wrote to memory of 1436	1004	msvce32.exe	86
PID 1004 wrote to memory of 1436	1004	msvce32.exe	86
PID 1436 wrote to memory of 2056	1436	msvce32.exe	88
PID 1436 wrote to memory of 2056	1436	msvce32.exe	88
PID 1436 wrote to memory of 2056	1436	msvce32.exe	88
PID 2056 wrote to memory of 3180	2056	msvce32.exe	91
PID 2056 wrote to memory of 3180	2056	msvce32.exe	91
PID 2056 wrote to memory of 3180	2056	msvce32.exe	91
PID 3180 wrote to memory of 3992	3180	msvce32.exe	92
PID 3180 wrote to memory of 3992	3180	msvce32.exe	92
PID 3180 wrote to memory of 3992	3180	msvce32.exe	92
PID 3992 wrote to memory of 5112	3992	msvce32.exe	93
PID 3992 wrote to memory of 5112	3992	msvce32.exe	93
PID 3992 wrote to memory of 5112	3992	msvce32.exe	93
PID 5112 wrote to memory of 2828	5112	msvce32.exe	94
PID 5112 wrote to memory of 2828	5112	msvce32.exe	94
PID 5112 wrote to memory of 2828	5112	msvce32.exe	94
PID 2828 wrote to memory of 3576	2828	msvce32.exe	95
PID 2828 wrote to memory of 3576	2828	msvce32.exe	95
PID 2828 wrote to memory of 3576	2828	msvce32.exe	95
PID 3576 wrote to memory of 2640	3576	msvce32.exe	96
PID 3576 wrote to memory of 2640	3576	msvce32.exe	96
PID 3576 wrote to memory of 2640	3576	msvce32.exe	96
PID 2640 wrote to memory of 3292	2640	msvce32.exe	97
PID 2640 wrote to memory of 3292	2640	msvce32.exe	97
PID 2640 wrote to memory of 3292	2640	msvce32.exe	97
PID 3292 wrote to memory of 3956	3292	msvce32.exe	98
PID 3292 wrote to memory of 3956	3292	msvce32.exe	98
PID 3292 wrote to memory of 3956	3292	msvce32.exe	98
PID 3956 wrote to memory of 4112	3956	msvce32.exe	99
PID 3956 wrote to memory of 4112	3956	msvce32.exe	99
PID 3956 wrote to memory of 4112	3956	msvce32.exe	99
PID 4112 wrote to memory of 3628	4112	msvce32.exe	100
PID 4112 wrote to memory of 3628	4112	msvce32.exe	100
PID 4112 wrote to memory of 3628	4112	msvce32.exe	100
PID 3628 wrote to memory of 2132	3628	msvce32.exe	101
PID 3628 wrote to memory of 2132	3628	msvce32.exe	101
PID 3628 wrote to memory of 2132	3628	msvce32.exe	101
PID 2132 wrote to memory of 4964	2132	msvce32.exe	102
PID 2132 wrote to memory of 4964	2132	msvce32.exe	102
PID 2132 wrote to memory of 4964	2132	msvce32.exe	102
PID 4964 wrote to memory of 1304	4964	msvce32.exe	103
PID 4964 wrote to memory of 1304	4964	msvce32.exe	103
PID 4964 wrote to memory of 1304	4964	msvce32.exe	103
PID 1304 wrote to memory of 4880	1304	msvce32.exe	104
PID 1304 wrote to memory of 4880	1304	msvce32.exe	104
PID 1304 wrote to memory of 4880	1304	msvce32.exe	104
PID 4880 wrote to memory of 2872	4880	msvce32.exe	105
PID 4880 wrote to memory of 2872	4880	msvce32.exe	105
PID 4880 wrote to memory of 2872	4880	msvce32.exe	105
PID 2872 wrote to memory of 212	2872	msvce32.exe	106
PID 2872 wrote to memory of 212	2872	msvce32.exe	106
PID 2872 wrote to memory of 212	2872	msvce32.exe	106
PID 212 wrote to memory of 2564	212	msvce32.exe	107
PID 212 wrote to memory of 2564	212	msvce32.exe	107
PID 212 wrote to memory of 2564	212	msvce32.exe	107
PID 2564 wrote to memory of 4148	2564	msvce32.exe	108

C:\Users\Admin\AppData\Local\Temp\a5712f8112f633c57a233814bb3923f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a5712f8112f633c57a233814bb3923f9_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\msvce32.exe
  C:\Windows\system32\msvce32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\msvce32.exe
    C:\Windows\system32\msvce32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\SysWOW64\msvce32.exe
      C:\Windows\system32\msvce32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
      - C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        13⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        18⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        23⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        24⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        25⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        26⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        28⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        29⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        30⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        31⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        32⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        34⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        35⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4512
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:264
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        38⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        39⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        40⤵
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        41⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        42⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        43⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        44⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        45⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        46⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        47⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:852
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1544
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        50⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        51⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        52⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        54⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        55⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        56⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1556
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        59⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3544
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        61⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4720
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        63⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        64⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:668
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        66⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        67⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        68⤵
        Modifies WinLogon for persistence
        
        PID:1484
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        69⤵
        Drops file in System32 directory
        
        PID:2008
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        70⤵
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        71⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        72⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        73⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        74⤵
        
        PID:756
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        75⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        77⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        78⤵
        
        PID:680
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        79⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        80⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        81⤵
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        82⤵
        Drops file in System32 directory
        
        PID:1372
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        83⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        84⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        85⤵
        Modifies WinLogon for persistence
        
        PID:3548
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        86⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        87⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        88⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        89⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        90⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        93⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        94⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        95⤵
        Modifies WinLogon for persistence
        
        PID:5320
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        96⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        97⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        98⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        99⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        100⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        101⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        102⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        103⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        104⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        105⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        107⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        108⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        109⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        111⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        112⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        113⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        114⤵
        Modifies WinLogon for persistence
        
        PID:5876
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        115⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        116⤵
        Modifies WinLogon for persistence
        
        PID:5920
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        117⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        119⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        120⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        122⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        123⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        125⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        128⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        129⤵
        Modifies WinLogon for persistence
        
        PID:5544
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        131⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        132⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        133⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        134⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        136⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        137⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        138⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        140⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        141⤵
        Drops file in System32 directory
        
        PID:5668
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        142⤵
        Modifies WinLogon for persistence
        
        PID:6164
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        143⤵
        Modifies WinLogon for persistence
        
        PID:6184
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        144⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        145⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        146⤵
        Modifies WinLogon for persistence
        
        PID:6248
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        147⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        149⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        153⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        154⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        155⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        158⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        159⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        160⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        161⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        162⤵
        Modifies WinLogon for persistence
        
        PID:6580
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        163⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        164⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        165⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        166⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        167⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        168⤵
        Modifies WinLogon for persistence
        
        PID:6748
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        170⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        171⤵
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        173⤵
        Modifies WinLogon for persistence
        
        PID:6848
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        174⤵
        Modifies WinLogon for persistence
        
        PID:6868
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        175⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        176⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        177⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        178⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        180⤵
        Modifies WinLogon for persistence
        
        PID:6988
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        181⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        182⤵
        Modifies WinLogon for persistence
        
        PID:7032
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        183⤵
        Modifies WinLogon for persistence
        
        PID:7052
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        184⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        185⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        186⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        187⤵
        Modifies WinLogon for persistence
        
        PID:7132
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        188⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        190⤵
        
        PID:620
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        191⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        192⤵
        Modifies WinLogon for persistence
        
        PID:4072
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        193⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        195⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        196⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        197⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        198⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        200⤵
        Modifies WinLogon for persistence
        
        PID:6856
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        201⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        202⤵
        Modifies WinLogon for persistence
        
        PID:6996
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        203⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        204⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        205⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        206⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        207⤵
        
        PID:924
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        208⤵
        Drops file in System32 directory
        
        PID:4220
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        209⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        210⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        211⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        213⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        214⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        215⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        216⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        217⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        220⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        222⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        223⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        224⤵
        Modifies WinLogon for persistence
        
        PID:7540
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        225⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        226⤵
        Modifies WinLogon for persistence
        
        PID:7584
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        227⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        228⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        229⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        230⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:7684
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        231⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        232⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        233⤵
        Modifies WinLogon for persistence
        
        PID:7752
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        234⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        235⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        236⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        237⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        238⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        239⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        240⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        241⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        243⤵
        Modifies WinLogon for persistence
        
        PID:7992
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        244⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        245⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        246⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        247⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        248⤵
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        249⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        250⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        251⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        252⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        253⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        254⤵
        Modifies WinLogon for persistence
        
        PID:7372
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        255⤵
        Modifies WinLogon for persistence
        
        PID:7424
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        256⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        257⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        258⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        259⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        260⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        261⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        263⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        264⤵
        Modifies WinLogon for persistence
        
        PID:456
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        265⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        266⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        267⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        268⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        269⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        270⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        271⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        272⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        273⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        274⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        275⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        276⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        277⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:8296
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        278⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8336
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        280⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:8376
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        282⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        283⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        285⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        286⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        287⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:8496
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        288⤵
        Modifies WinLogon for persistence
        
        PID:8516
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        289⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:8556
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        291⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        293⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        294⤵
        Modifies WinLogon for persistence
        
        PID:8640
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        295⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        296⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        297⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        298⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        299⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        300⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        301⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        302⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        303⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        304⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        305⤵
        Modifies WinLogon for persistence
        
        PID:8860
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        306⤵
        Modifies WinLogon for persistence
        
        PID:8884
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        309⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        310⤵
        Drops file in System32 directory
        
        PID:8964
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        311⤵
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        312⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        313⤵
        Drops file in System32 directory
        
        PID:9024
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        314⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        315⤵
        Modifies WinLogon for persistence
        
        PID:9064
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        316⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        317⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        318⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        319⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        320⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        321⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        322⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        323⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        324⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        325⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        326⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        327⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        328⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        330⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:9196
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        331⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        332⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        333⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        334⤵
        Drops file in System32 directory
        
        PID:9164
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        335⤵
        Modifies WinLogon for persistence
        
        PID:784
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        336⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        337⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9112
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        338⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        339⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        340⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        341⤵
        Modifies WinLogon for persistence
        
        PID:9544
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        342⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        343⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        344⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        345⤵
        Modifies WinLogon for persistence
        
        PID:9896
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        346⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        347⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        348⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        349⤵
        Modifies WinLogon for persistence
        
        PID:1004
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        351⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        352⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        353⤵
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        354⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        355⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:10176
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        356⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        357⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        358⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        359⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        360⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        361⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        362⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:10220
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        364⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        365⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        366⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        367⤵
        Modifies WinLogon for persistence
        
        PID:10472
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        368⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        369⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        370⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        
        PID:10748
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        371⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        372⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\msvce32.exe
        
        C:\Windows\system32\msvce32.exe
        373⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        373⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        372⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        371⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        370⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        369⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        368⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        367⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        366⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        364⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        363⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        362⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        361⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        360⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        359⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        358⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        356⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        355⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        354⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        353⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        352⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        351⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        350⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        349⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        347⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        346⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        345⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        344⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        343⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        342⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        341⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        340⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        339⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        338⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        337⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        336⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        335⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        334⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        333⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        332⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        331⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        330⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        329⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        328⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        327⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        326⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        325⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        324⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        323⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        322⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        321⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:10912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        319⤵
        System Location Discovery: System Language Discovery
        
        PID:10936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        318⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        317⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        316⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        315⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        313⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        312⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        311⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        310⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        309⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        308⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        307⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        306⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        305⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        304⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        303⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        302⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        301⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        300⤵
        
        PID:464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        299⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        298⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        297⤵
        
        PID:396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        296⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        295⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        294⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        293⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        292⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        291⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        290⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        289⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        288⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        287⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        286⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        285⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        284⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        283⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        282⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        281⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        280⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        279⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        278⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        277⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        276⤵
        
        PID:796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        275⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        274⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        273⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        272⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        271⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        270⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        269⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        268⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        267⤵
        
        PID:32
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        266⤵
        
        PID:748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        265⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        264⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        263⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        262⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        261⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        260⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        259⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        258⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        257⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        256⤵
        System Location Discovery: System Language Discovery
        
        PID:8820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        255⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        254⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        253⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        252⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        251⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        250⤵
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        249⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        248⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        247⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        246⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        245⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        244⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        243⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        242⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        241⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        239⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        238⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        237⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        236⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        235⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        234⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        233⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        232⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        231⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        230⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        229⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        228⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        227⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        226⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        225⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        224⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        223⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        222⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        221⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        220⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        219⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:9116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        217⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        216⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        215⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        214⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        213⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        212⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        211⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        210⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        209⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        207⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        206⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        204⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        203⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        202⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        201⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        200⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        199⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        198⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        197⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        196⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        195⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        194⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        193⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        192⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        191⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        190⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        189⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        188⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        187⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        186⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        185⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        184⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        183⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        182⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        181⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        180⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        179⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        178⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:8384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        176⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        174⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        173⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        172⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        171⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        170⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        169⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        168⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        167⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        166⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        165⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        164⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        163⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        162⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        161⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        160⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        158⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        157⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        156⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        154⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        153⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        152⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        151⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        150⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        149⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        148⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        147⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        146⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        145⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        144⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        143⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        142⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        141⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        140⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        139⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        138⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        137⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        136⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        135⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        134⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        133⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:9840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        130⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:8168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        128⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        127⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        126⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        125⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        124⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        123⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        121⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        120⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        119⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        118⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        117⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        116⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        115⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        114⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        113⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        112⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        111⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        110⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        109⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        108⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        107⤵
        
        PID:620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        106⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        105⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        104⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        103⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        102⤵
        
        PID:784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        101⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        100⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        99⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        98⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        97⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        96⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        95⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        93⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        92⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        91⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        90⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        89⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        88⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        87⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        86⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        85⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        84⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        83⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        82⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        81⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        80⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        79⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        78⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        77⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        76⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        75⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        74⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        73⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        72⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        71⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        70⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        69⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        68⤵
        
        PID:656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        67⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        66⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        65⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        64⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        63⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        62⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        61⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        60⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        59⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        58⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        57⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        56⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        55⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        53⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        52⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        51⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        50⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        49⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        48⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        47⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        46⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        45⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        44⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        43⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        42⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        40⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        39⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        38⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        37⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        36⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        35⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        34⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        33⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        32⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        31⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        30⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        29⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        28⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        27⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        26⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        25⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        24⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        23⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        22⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        21⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        20⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        19⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        18⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        17⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        16⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:10208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        14⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        13⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        12⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        11⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        10⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        9⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        8⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        7⤵
        
        PID:9488
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        6⤵
        
        PID:9404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
        5⤵
        
        PID:9304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
      4⤵
      PID:1824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
    3⤵
    PID:116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:944

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat

Filesize
106B

MD5
6cb499923b7f03162cc2956e227f0195

SHA1
239da174aec825b3d35b32995456ea0e369996d6

SHA256
34b9f0adc99e0fb861eb6df07fd6d910c525d28bd24600f42d43eb862287c71c

SHA512
a70518bbb3095368d56da287f8b8524f56cc0be95aabd698952611a52724b670996ebe2a760cb958470aebc51ed5c87ed46995a7afbcf1cfec5684b401246f16

Download Submit
C:\Windows\SysWOW64\msvce32.exe

Filesize
171KB

MD5
a5712f8112f633c57a233814bb3923f9

SHA1
275494bcf3cde45f981c9d93c373f7642811b260

SHA256
192a9a72f08373b3f16996fe7bbcddb9f7ef0a04cdb846220812a36e5bfd906b

SHA512
30186c153c1eb38994544a7bd4b1d4d28d93579a1783303f38888d54cdd79d0dd2992b44ec3b01c57765b260b92fce963d03333be0770d6c027b61341e373832

Download Submit
memory/212-85-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/264-117-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/448-119-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/852-139-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/928-156-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1004-35-0x00000000020E0000-0x0000000002123000-memory.dmp

Filesize
268KB

Download
memory/1004-43-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1004-45-0x00000000020E0000-0x0000000002123000-memory.dmp

Filesize
268KB

Download
memory/1224-103-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1304-79-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1368-105-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1436-50-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1476-12-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1476-3-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1476-16-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1476-15-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1476-14-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1476-13-0x00000000023E0000-0x00000000023E6000-memory.dmp

Filesize
24KB

Download
memory/1476-18-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1476-19-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1476-9-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/1476-27-0x0000000002210000-0x0000000002253000-memory.dmp

Filesize
268KB

Download
memory/1476-26-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1476-10-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1476-11-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1476-17-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1476-1-0x0000000002210000-0x0000000002253000-memory.dmp

Filesize
268KB

Download
memory/1476-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1476-2-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/1476-4-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1476-8-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1476-5-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1476-6-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1476-7-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1480-113-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1544-141-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1556-154-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1612-147-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-99-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2056-52-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2132-75-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2544-131-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2548-161-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2564-87-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2616-155-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2640-65-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2684-107-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2828-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2872-83-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3024-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3052-152-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3140-91-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3148-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3180-54-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3212-101-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3292-67-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3492-97-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3544-157-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3576-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3628-73-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3692-143-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3956-69-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3964-149-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3972-158-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3992-56-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4112-71-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4148-89-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4216-111-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4244-129-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4364-123-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4400-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4512-115-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4560-151-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4620-32-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4620-29-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4620-25-0x0000000001F80000-0x0000000001FC3000-memory.dmp

Filesize
268KB

Download
memory/4620-193-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4620-24-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4620-28-0x00000000022E0000-0x00000000022E6000-memory.dmp

Filesize
24KB

Download
memory/4620-39-0x00000000022E0000-0x00000000022E6000-memory.dmp

Filesize
24KB

Download
memory/4620-31-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4620-30-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/4620-34-0x0000000001F80000-0x0000000001FC3000-memory.dmp

Filesize
268KB

Download
memory/4676-145-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4708-127-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4720-159-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4736-153-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4752-93-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4764-125-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4868-121-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4880-81-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4880-61-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4920-109-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4964-77-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4980-95-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4988-160-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5112-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads