xorist | d27b11aef2338d211b7ece957cdd00af16c6c6718f19dcae80b872e7adbad561

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe
Size

36KB
MD5

8e3cb7a9bdf0add317bf3945bd7a5c01
SHA1

d8a96a84f61027d2913801414e8b3e8dde8d08f6
SHA256

d27b11aef2338d211b7ece957cdd00af16c6c6718f19dcae80b872e7adbad561
SHA512

17d056aa575238e4d1d241dbd916c3d31fc62b81d416fee809b6d36d6f4f3e76b2668a32e5621c537e6b1fb76d5f7bdf8ab837310cab9ca6931f9b9f3aef4c20
SSDEEP

768:AQGiHdn+ZnPW6hduWmSdFkHA+9HFiesI4Wn2b7o8Ekj:/VHx+ZnDjuPgER4W2bXEkj

Score

10^/10

xorist discovery persistence ransomware upx

Malware Config

Signatures

Detected Xorist Ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1916-121-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist

Executes dropped EXE 4 IoCs

pid	Process
2360	joined.exe
1816	1.exe
1656	joined.exe
1916	loleee.exe

Loads dropped DLL 8 IoCs

pid	Process
792	8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe
792	8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe
2360	joined.exe
2360	joined.exe
1816	1.exe
1816	1.exe
1656	joined.exe
1656	joined.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.bat"	reg.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1656-112-0x0000000001D00000-0x0000000001D0C000-memory.dmp	upx
behavioral1/files/0x0006000000016edc-110.dat	upx
behavioral1/memory/1916-121-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Win32.bat	cmd.exe
File opened for modification	C:\Windows\Win32.bat	cmd.exe
File created	C:\Windows\Win32.bat	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	joined.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2276	taskkill.exe
2808	taskkill.exe
2592	taskkill.exe
2940	taskkill.exe
2696	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2700	reg.exe
2728	reg.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
3040	NOTEPAD.EXE
2600	NOTEPAD.EXE
2088	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2360	792	8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe	31
PID 792 wrote to memory of 2360	792	8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe	31
PID 792 wrote to memory of 2360	792	8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe	31
PID 792 wrote to memory of 2360	792	8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe	31
PID 2360 wrote to memory of 1816	2360	joined.exe	32
PID 2360 wrote to memory of 1816	2360	joined.exe	32
PID 2360 wrote to memory of 1816	2360	joined.exe	32
PID 2360 wrote to memory of 1816	2360	joined.exe	32
PID 2360 wrote to memory of 2796	2360	joined.exe	33
PID 2360 wrote to memory of 2796	2360	joined.exe	33
PID 2360 wrote to memory of 2796	2360	joined.exe	33
PID 2360 wrote to memory of 2796	2360	joined.exe	33
PID 2796 wrote to memory of 2940	2796	cmd.exe	35
PID 2796 wrote to memory of 2940	2796	cmd.exe	35
PID 2796 wrote to memory of 2940	2796	cmd.exe	35
PID 2796 wrote to memory of 2940	2796	cmd.exe	35
PID 2796 wrote to memory of 2696	2796	cmd.exe	36
PID 2796 wrote to memory of 2696	2796	cmd.exe	36
PID 2796 wrote to memory of 2696	2796	cmd.exe	36
PID 2796 wrote to memory of 2696	2796	cmd.exe	36
PID 2796 wrote to memory of 2276	2796	cmd.exe	37
PID 2796 wrote to memory of 2276	2796	cmd.exe	37
PID 2796 wrote to memory of 2276	2796	cmd.exe	37
PID 2796 wrote to memory of 2276	2796	cmd.exe	37
PID 2796 wrote to memory of 2808	2796	cmd.exe	38
PID 2796 wrote to memory of 2808	2796	cmd.exe	38
PID 2796 wrote to memory of 2808	2796	cmd.exe	38
PID 2796 wrote to memory of 2808	2796	cmd.exe	38
PID 2796 wrote to memory of 2592	2796	cmd.exe	39
PID 2796 wrote to memory of 2592	2796	cmd.exe	39
PID 2796 wrote to memory of 2592	2796	cmd.exe	39
PID 2796 wrote to memory of 2592	2796	cmd.exe	39
PID 2796 wrote to memory of 2700	2796	cmd.exe	40
PID 2796 wrote to memory of 2700	2796	cmd.exe	40
PID 2796 wrote to memory of 2700	2796	cmd.exe	40
PID 2796 wrote to memory of 2700	2796	cmd.exe	40
PID 2796 wrote to memory of 2728	2796	cmd.exe	41
PID 2796 wrote to memory of 2728	2796	cmd.exe	41
PID 2796 wrote to memory of 2728	2796	cmd.exe	41
PID 2796 wrote to memory of 2728	2796	cmd.exe	41
PID 2796 wrote to memory of 2608	2796	cmd.exe	42
PID 2796 wrote to memory of 2608	2796	cmd.exe	42
PID 2796 wrote to memory of 2608	2796	cmd.exe	42
PID 2796 wrote to memory of 2608	2796	cmd.exe	42
PID 1816 wrote to memory of 2600	1816	1.exe	43
PID 1816 wrote to memory of 2600	1816	1.exe	43
PID 1816 wrote to memory of 2600	1816	1.exe	43
PID 1816 wrote to memory of 2600	1816	1.exe	43
PID 1816 wrote to memory of 2088	1816	1.exe	44
PID 1816 wrote to memory of 2088	1816	1.exe	44
PID 1816 wrote to memory of 2088	1816	1.exe	44
PID 1816 wrote to memory of 2088	1816	1.exe	44
PID 1816 wrote to memory of 3040	1816	1.exe	45
PID 1816 wrote to memory of 3040	1816	1.exe	45
PID 1816 wrote to memory of 3040	1816	1.exe	45
PID 1816 wrote to memory of 3040	1816	1.exe	45
PID 1816 wrote to memory of 1460	1816	1.exe	46
PID 1816 wrote to memory of 1460	1816	1.exe	46
PID 1816 wrote to memory of 1460	1816	1.exe	46
PID 1816 wrote to memory of 1460	1816	1.exe	46
PID 1816 wrote to memory of 1324	1816	1.exe	47
PID 1816 wrote to memory of 1324	1816	1.exe	47
PID 1816 wrote to memory of 1324	1816	1.exe	47
PID 1816 wrote to memory of 1324	1816	1.exe	47

C:\Users\Admin\AppData\Local\Temp\8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8e3cb7a9bdf0add317bf3945bd7a5c01_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\joined.exe
  "C:\Users\Admin\AppData\Local\Temp\joined.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\1.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:2600
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\2.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:2088
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\3.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:3040
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\123.bat" "
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:1460
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2392
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:648
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1924
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1416
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:924
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1524
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:848
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1812
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1532
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1244
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1492
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1852
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2356
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2344
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1976
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:896
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1956
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1580
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1200
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2472
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:2708
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3052
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2784
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1800
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2840
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2888
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:276
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2948
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2464
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2568
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1568
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1224
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1484
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1048
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:536
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1876
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1040
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:900
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2144
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2744
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1872
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2180
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1728
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1712
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2244
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2444
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:908
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1560
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1704
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:584
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2784
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2360
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2400
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:2828
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2476
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3036
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2556
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1484
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:560
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1948
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2776
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3056
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:764
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1104
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1820
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2444
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:852
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1704
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1812
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2936
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2304
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2220
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:764
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:2504
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2176
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2636
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2860
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2264
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2804
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2164
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1712
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1200
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:2800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1876
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1700
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3100
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3128
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3164
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3188
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3224
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3244
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3268
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3296
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3320
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3340
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3376
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3440
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:3472
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3492
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3552
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:3580
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3612
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3636
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3660
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:3688
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3720
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3748
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3840
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3860
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3884
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:3908
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3936
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3956
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4028
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4060
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4080
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3132
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3256
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3296
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3344
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3264
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3404
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3276
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3484
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3584
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3648
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3700
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3608
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3804
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3856
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:3952
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3980
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4084
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3148
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2140
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:3232
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2812
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3336
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3368
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3200
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3512
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3748
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3800
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3924
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3984
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3128
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3340
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3564
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3568
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3760
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3900
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:3948
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3236
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3336
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:3484
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3564
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3560
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4144
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4172
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4236
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4264
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4296
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4316
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4368
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4388
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4548
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4568
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4604
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4632
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4656
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:4676
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4708
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4728
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4768
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4792
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4820
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4856
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4892
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:4920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4968
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5008
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5068
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5112
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4100
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4164
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3948
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4220
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4268
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4356
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4280
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4388
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4464
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4520
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4412
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:4628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4676
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4732
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4804
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4792
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4840
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4916
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4888
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5108
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4136
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3628
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:4216
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4188
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4196
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4560
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4520
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4588
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4740
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4680
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4272
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4720
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4316
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:4628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4720
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:4856
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4520
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5064
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:4844
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5140
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5160
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5208
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5236
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5264
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5292
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5312
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5332
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5372
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5404
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5440
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5460
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5496
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5544
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5616
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5648
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5700
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5732
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5760
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5800
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5820
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5852
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5908
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5936
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5980
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6060
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6092
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6112
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5196
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5292
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5348
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5368
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5364
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5512
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5532
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5748
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5820
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5784
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5884
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6124
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5896
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5148
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5196
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5392
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4216
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5304
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5624
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5580
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:944
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5808
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5784
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5152
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5980
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5436
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5260
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1788
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5712
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4856
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5492
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5968
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:5920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5900
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:1732
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5932
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:952
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5864
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:2832
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5572
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5488
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6048
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:5928
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5928
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6168
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6200
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6228
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6252
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6284
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6312
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:6332
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6372
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6392
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6452
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6488
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:6508
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6536
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6612
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6632
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6664
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:6684
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6740
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6832
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6864
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6900
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6952
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6972
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7004
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7064
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7084
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7112
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7140
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7164
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6172
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5160
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6232
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6344
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:6292
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6464
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6236
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6520
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:6564
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6628
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:6696
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6528
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6788
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:6852
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6876
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6924
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6984
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7040
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:7144
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7000
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6172
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6332
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6236
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6572
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2844
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6856
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7016
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6180
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6920
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6944
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6508
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6732
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6696
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6308
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7136
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6804
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6672
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6912
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6308
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6804
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:6804
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7208
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7236
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7256
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7284
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7372
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7436
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7464
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7524
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7556
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7580
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7636
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7664
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7692
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7728
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7760
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7836
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7864
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7888
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7916
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7992
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8016
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8064
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:8084
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8120
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8140
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5472
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7224
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7272
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7284
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:6972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7452
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7516
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7572
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7688
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7748
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7792
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7608
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7848
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7896
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7940
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:7988
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:8044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8140
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7288
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8168
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8060
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7452
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7012
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7580
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7776
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2648
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7712
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7980
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7996
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8144
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7312
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8168
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7412
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7632
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7420
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:1824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:7976
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8028
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7180
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7448
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7412
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7420
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7912
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8140
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7452
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7980
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:7576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:7180
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8208
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8224
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8244
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8272
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8300
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8324
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8352
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8376
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8404
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8428
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8460
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8512
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8528
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8556
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8580
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8624
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8644
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8668
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:8700
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8724
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:8744
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8776
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8796
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8832
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8852
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8876
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8904
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8932
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8952
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8980
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9000
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9052
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9092
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9112
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9140
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9168
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9188
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9208
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8212
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:7740
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8284
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8356
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8408
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8444
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8496
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8560
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8612
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8640
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8688
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8732
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8840
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8892
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:8940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8956
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9012
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9048
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9160
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9204
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8236
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:7740
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8452
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:8512
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8560
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1108
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8588
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8844
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9052
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9152
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8244
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8444
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8632
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8844
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8996
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9172
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8444
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8808
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8944
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8504
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:8800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:8336
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9204
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9260
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9276
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9296
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9324
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9352
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9368
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9388
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9416
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9436
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9460
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9480
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9508
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9528
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9552
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9580
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9596
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9616
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9644
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9672
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9688
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9708
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9736
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9756
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9808
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9852
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9888
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9916
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        
        PID:9936
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:9988
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10008
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:10036
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10052
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:10080
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10096
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:10116
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10144
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:10172
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10188
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:10208
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:10232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9264
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9308
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9312
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9392
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9428
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9472
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9516
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9528
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9584
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9668
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9700
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9752
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9844
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:9888
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:9940
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\1234.bat" "
      4⤵
      PID:1324
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\22323.bat" "
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\111111111.bat" "
      4⤵
      PID:2540
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2952
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2880
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:992
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2836
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2200
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:1812
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2164
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2836
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:1828
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:972
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:992
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2708
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3212
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3432
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3604
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3788
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4052
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3308
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4076
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3484
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3116
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:3628
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4196
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4408
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4828
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5060
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4376
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4688
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4828
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4704
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5032
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4216
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5256
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5488
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5672
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5896
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5044
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5848
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:4740
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5764
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2024
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:5044
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:6236
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:6476
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:6756
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:6944
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:6208
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:6972
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:7416
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:7608
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:7820
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:8008
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:7464
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\11111111111.bat" "
      4⤵
      Drops file in Windows directory
      PID:1148
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
        5⤵
        
        PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\joined.exe
      "C:\Users\Admin\AppData\Local\Temp\joined.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\loleee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loleee.exe"
        5⤵
        Executes dropped EXE
        
        PID:1916
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\i_love_you.vbs"
        5⤵
        
        PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im /f chrome.exe
      4⤵
      Kills process with taskkill
      PID:2940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im /f ie.exe
      4⤵
      Kills process with taskkill
      PID:2696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im /f firefox.exe
      4⤵
      Kills process with taskkill
      PID:2276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im /f opera.exe
      4⤵
      Kills process with taskkill
      PID:2808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im /f safari.exe
      4⤵
      Kills process with taskkill
      PID:2592
  - - C:\Windows\SysWOW64\reg.exe
      Reg Delete HKLM\System\CurrentControlSet\Control\SafeBoot\*.* /q
      4⤵
      Modifies registry key
      PID:2700
  - - C:\Windows\SysWOW64\reg.exe
      Reg Delete HKLM\System\CurrentControlSet\Control\SafeBoot /q
      4⤵
      Modifies registry key
      PID:2728
  - - C:\Windows\SysWOW64\mode.com
      mode con cols=300 lines=300
      4⤵
      PID:2608

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "11817078581974467538-15086866717006453051205431708-1903781886-4921286211204229602"
1⤵
PID:1916

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14762783771887363655-15656426-18417912841392640041-4169299461473666269-1377574175"
1⤵
PID:2568

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1447540819203354753488729140-17481330031395807336-17597870531997233900-677753023"
1⤵
PID:2456

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1966563322673436639826905311228876532-387197619-77584911-12243789701372949707"
1⤵
PID:2776

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1749871129-49345047141608701117014716651545658018-1494278207-775778319-226896933"
1⤵
PID:2304

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-982723250896950605120414649016823589521936694567-846178752-205502783106676237"
1⤵
PID:2444

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-5764278181068092577-6668670171513266680-1657378336136099468404921965-454864472"
1⤵
PID:2164

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3260511032108058889-390289265-979862073-211756297657948665673992417-2023305885"
1⤵
PID:3580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13793182471781644675994882778-119842492-13174121091933538503-1946043213-2145400092"
1⤵
PID:3860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1575462930-903449346-11672249779869549751710320345-18039791519218877921430562033"
1⤵
PID:3404

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "122479609715769450231174945505-1323235950-16577446621732596080-694463947305670581"
1⤵
PID:3648

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "672877637752746601579785523-560384214-2050885152-264269483624472938759354595"
1⤵
PID:3748

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "626728867-456068454-1956449433278470268-1604427275-166317509911379456281081155328"
1⤵
PID:3184

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1666984499-6563364182097296425-769265370-15319166051538837748950442833259782438"
1⤵
PID:4920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-5882053753311154911030043698384645194-1418418412772389369-1097806551391426191"
1⤵
PID:4220

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "33522375018093040819452224431673741430978289134734366671-7800102652145142773"
1⤵
PID:4888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "411801345-262558049-505666147-1327714316675968746-8331171284372174841256254959"
1⤵
PID:4356

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-287696213612714153-613661224167096260512900376811728695963-674231987450098435"
1⤵
PID:4400

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12537812781703118864-2131135051112598234-20340282492053625427858303652724407459"
1⤵
PID:4468

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-735335262-7186671011675498566-11652365001477097950-1857741619-1182890880875976383"
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
586B

MD5
42b8ac858501fb5599aa36fab93a68cb

SHA1
28395a8e27d4ab76fdd44906c75d091edf05fbe8

SHA256
bece1215fc11acd5563adf9c5e7e8646b372cd76870ab59b7d72f1905db309c6

SHA512
43c1a5a0403c636b13f63ef85f6d750b2953b13f5f453f6d4c3df6e14a2ec52be844e35af5eb9709161e3487b005786a138f127465534017f8a7bf988a683888

Download Submit
C:\Users\Admin\AppData\Local\Temp\111111111.bat

Filesize
597B

MD5
f98a22300df9ca51692e0f53fb765a17

SHA1
a6ce88e1d9bb9af200b07b35d7dbad6980772c06

SHA256
3bde21e36850c2736f81b506f382b74d758b95a8a6d16955156e025e8b37b052

SHA512
2c86973c70767effd8130599e088b6f860b842de0ba1b6a86253cad178facd05bb5d68ed26094f6dc31548cb77d571dbc7e8ffc8e5e9b4d17e0ae5e83c359368

Download Submit
C:\Users\Admin\AppData\Local\Temp\11111111111.bat

Filesize
299B

MD5
9c0d6dd7590b85383f92110ba2067ab8

SHA1
4a6f1c8a8ab60bebcae64ad3805c9e5cba573f62

SHA256
dc0d8e7e507daf70309f4c11006d7ccdbd0ab61561bf7abb918d6c037f36c776

SHA512
054a5f274d83baafd68adb3d5ceb14ba6692a312710c4b49637500f1332f4779fae45d2d4da6720431541e8ff31e360ac1a3bd565c6b1a42a8969ce1f16745f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\123.bat

Filesize
261B

MD5
687493c0c554ef0fd64a465489ebfec3

SHA1
95ee9e48ca1e37f1649b19563bfbfc9d3e89f96c

SHA256
f6c7fd9583079b635bc287f16a75b523a8c7835ebfec507651acafcc6f9e2949

SHA512
4513de64db18483cf7951612f94aec62c2a2f987b4c45f1954ea813d9ff6b61dedf974c2a64f94acfde85b1bd1cc67b42adc999c9e5bd30160ef6738c8b22f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\1234.bat

Filesize
180B

MD5
b1c85e1d07e17b862e30f06facc507f0

SHA1
6ecbdfc4df627a99141cbdf198a2f28c74a257da

SHA256
742ddd73414f8eeba7c0810e4e8cb2b709679a4a40abe7358e264b7598852a25

SHA512
b349cda563eea04b4a66d173f7a624b903758acd0607fa27c6f2c7caac2d014341a61c05c22970ed0941a4b054ae5cc5bf5a39fed2edb1223507235773c302e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\22323.bat

Filesize
428B

MD5
e30cf4127b621f2a1bcee6e3ccc7f314

SHA1
252c9cc9c18c45f6197aca02c914347afc69626c

SHA256
380f98c3439484f2c98d026fc4e914e37af99dc5ba3ac304a9b06f1199b4aaa4

SHA512
8abca2910dbcdaa526cfec4da59baf743cf838b7683e80479f3165a14a24df7eb1febc7eb85398270a4828442e42a520351ded790193f7785e3f67b679345444

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.txt

Filesize
471B

MD5
34fabeb198e7e9a704878a1772f827fb

SHA1
62c967ac7c815acc145e4c552a451feb8a5ec631

SHA256
8356511f876c457169f1a9add844d3251b61044445e0c5bdb7a2564f4a5b0336

SHA512
067af4b6fbb65860f13178dd580310f954e2fa2c923bae32e70b955f4c53c73ee5890f6f3aeeb2e182bddbf71caa1d0de46f1d5e4a08ae78fedf65d3b58d24bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\i_love_you.vbs

Filesize
10KB

MD5
6fd161f0b621317ef1b11c5691968789

SHA1
55573a2394acd37487c7c129e518b5aeba6e53de

SHA256
34425666bf83376566898bdedbf828ed604ec134d3a7f9bdc34184c4b79fa490

SHA512
3ba1441e64131d4bf1d6f88a41cd4463635a0e15d6b5685afb975ae9703055a3c40441c0abe8e434285041d78f3c96fc53a06ff5666930095c5b4472bf3dd072

Download Submit
\Users\Admin\AppData\Local\Temp\1.exe

Filesize
23KB

MD5
72e95ba3f379d5edda2f933980431d08

SHA1
e898ed60318be75fc2525deda7b4707c7fb8c204

SHA256
734afd64d44d53fa04cf8594c0309f38ecd0e0c575930a8d45e11d902615dba6

SHA512
48c1a1bcb7cea426c42f3249338f0a07777d8e80bbee816b6c3db34ae847d56d51cd8e051d8194a1b9a90db7fb15a0661afad0f330579f590cdeef03a51e0528

Download Submit
\Users\Admin\AppData\Local\Temp\joined.exe

Filesize
29KB

MD5
498d7216dd86cee1f0edb3e899ef838d

SHA1
08954f301067f2db71d240d1d52a8f9eb8a868a3

SHA256
b8b83434b9d2ce49fde8ea763aaf521501b4f32831a4335d3f3cd05178db0d44

SHA512
81ff25b9d5d898e6116a0d4ddd7056a3d8d47ed4710a8c9f1dcee0f45cf48e3a6d60cd508a603b40ff7fdfe4eb440f149b1553e8e35ecbc20905db6bf5cc4549

Download Submit
\Users\Admin\AppData\Local\Temp\joined.exe

Filesize
16KB

MD5
632625f678bdb8971cc63663e03f0c6c

SHA1
a39855e1da3cd1d123f2ceab4ebcf25fbcf23851

SHA256
39a40f6614a014e84f388e31fdf428834175737fab5448b20746a82796c5f957

SHA512
9c3e20ccf67d2b02503a8d2a397785df93769adbd8df1b5c8ab80f344b6f4e24f5d4487d04e4fedfab758068c1a78679d0b7b53e12ca2fc73491cd3c8d2569e1

Download Submit
\Users\Admin\AppData\Local\Temp\loleee.exe

Filesize
6KB

MD5
c0359eff2544c2e59037b6bc57afb535

SHA1
39412f5c9e6fd624312441ccbd85a498aed9637c

SHA256
c955beab8021c516e967632d841aed7496c6bdaed70ddcaf65554dea48790a88

SHA512
76c279bf4fab8918207162950b684be6fff293b364bca0884184f9a4663b747d2fdc84052812056ed3d07fe32a313f25b8ce39e00a9403e7d7e3efca7fd97f68

Download Submit
memory/792-4-0x0000000002A20000-0x0000000002A3A000-memory.dmp

Filesize
104KB

Download
memory/1656-112-0x0000000001D00000-0x0000000001D0C000-memory.dmp

Filesize
48KB

Download
memory/1656-117-0x0000000001D00000-0x0000000001D0C000-memory.dmp

Filesize
48KB

Download
memory/1656-104-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1656-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1816-102-0x0000000000430000-0x0000000000447000-memory.dmp

Filesize
92KB

Download
memory/1816-97-0x0000000000430000-0x0000000000447000-memory.dmp

Filesize
92KB

Download
memory/1816-106-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1816-33-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1916-121-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2360-32-0x00000000024D0000-0x00000000024E9000-memory.dmp

Filesize
100KB

Download
memory/2360-35-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2360-17-0x00000000024D0000-0x00000000024E9000-memory.dmp

Filesize
100KB

Download
memory/2360-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads