latentbot | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a573b21a7be92000f27a3802bb3518.exe
Size

37KB
MD5

f9a573b21a7be92000f27a3802bb3518
SHA1

f1d683fa18e0877c057d201e9af7b518ae82c7d0
SHA256

8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce
SHA512

6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334
SSDEEP

384:b/iH4qi0/JZtbH9KyM+2bzmgHvis2gbjrAF+rMRTyN/0L+EcoinblneHQM3epzXW:Li7J95M+2b6g6tgnrM+rMRa8NuKft

Score

10^/10

latentbot defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

latentbot

holyfuckingshit.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5780	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	f9a573b21a7be92000f27a3802bb3518.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe

Executes dropped EXE 64 IoCs

pid	Process
2428	windows defender.exe
4240	windows defender.exe
6140	windows defender.exe
5292	windows defender.exe
1548	windows defender.exe
4180	windows defender.exe
2256	windows defender.exe
116	windows defender.exe
1972	windows defender.exe
5536	windows defender.exe
1908	windows defender.exe
3936	windows defender.exe
3576	windows defender.exe
5936	windows defender.exe
5036	windows defender.exe
220	windows defender.exe
432	windows defender.exe
6116	windows defender.exe
3052	windows defender.exe
5412	windows defender.exe
4328	windows defender.exe
5244	windows defender.exe
3724	windows defender.exe
4468	windows defender.exe
2076	windows defender.exe
5012	windows defender.exe
2864	windows defender.exe
3944	windows defender.exe
4240	windows defender.exe
1164	windows defender.exe
1616	windows defender.exe
3320	windows defender.exe
3488	windows defender.exe
5880	windows defender.exe
5464	windows defender.exe
2024	windows defender.exe
5656	windows defender.exe
3036	windows defender.exe
3480	windows defender.exe
3312	windows defender.exe
2252	windows defender.exe
2960	windows defender.exe
5308	windows defender.exe
2256	windows defender.exe
3080	windows defender.exe
4868	windows defender.exe
4480	windows defender.exe
4904	windows defender.exe
1892	windows defender.exe
2588	windows defender.exe
448	windows defender.exe
1908	windows defender.exe
5760	windows defender.exe
4988	windows defender.exe
4968	windows defender.exe
1672	windows defender.exe
4976	windows defender.exe
4372	windows defender.exe
3248	windows defender.exe
4700	windows defender.exe
3952	windows defender.exe
5920	windows defender.exe
948	windows defender.exe
5480	windows defender.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe
2428	windows defender.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2428	windows defender.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe
Token: 33	2428	windows defender.exe
Token: SeIncBasePriorityPrivilege	2428	windows defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2428	2760	f9a573b21a7be92000f27a3802bb3518.exe	94
PID 2760 wrote to memory of 2428	2760	f9a573b21a7be92000f27a3802bb3518.exe	94
PID 2760 wrote to memory of 2428	2760	f9a573b21a7be92000f27a3802bb3518.exe	94
PID 2428 wrote to memory of 5780	2428	windows defender.exe	97
PID 2428 wrote to memory of 5780	2428	windows defender.exe	97
PID 2428 wrote to memory of 5780	2428	windows defender.exe	97
PID 1920 wrote to memory of 4240	1920	cmd.exe	103
PID 1920 wrote to memory of 4240	1920	cmd.exe	103
PID 1920 wrote to memory of 4240	1920	cmd.exe	103
PID 4032 wrote to memory of 6140	4032	cmd.exe	104
PID 4032 wrote to memory of 6140	4032	cmd.exe	104
PID 4032 wrote to memory of 6140	4032	cmd.exe	104
PID 2180 wrote to memory of 1548	2180	cmd.exe	110
PID 2180 wrote to memory of 1548	2180	cmd.exe	110
PID 2180 wrote to memory of 1548	2180	cmd.exe	110
PID 752 wrote to memory of 5292	752	cmd.exe	109
PID 752 wrote to memory of 5292	752	cmd.exe	109
PID 752 wrote to memory of 5292	752	cmd.exe	109
PID 3472 wrote to memory of 4180	3472	cmd.exe	115
PID 3472 wrote to memory of 4180	3472	cmd.exe	115
PID 3472 wrote to memory of 4180	3472	cmd.exe	115
PID 2056 wrote to memory of 2256	2056	cmd.exe	116
PID 2056 wrote to memory of 2256	2056	cmd.exe	116
PID 2056 wrote to memory of 2256	2056	cmd.exe	116
PID 4044 wrote to memory of 116	4044	cmd.exe	121
PID 4044 wrote to memory of 116	4044	cmd.exe	121
PID 4044 wrote to memory of 116	4044	cmd.exe	121
PID 4976 wrote to memory of 1972	4976	cmd.exe	122
PID 4976 wrote to memory of 1972	4976	cmd.exe	122
PID 4976 wrote to memory of 1972	4976	cmd.exe	122
PID 780 wrote to memory of 5536	780	cmd.exe	127
PID 780 wrote to memory of 5536	780	cmd.exe	127
PID 780 wrote to memory of 5536	780	cmd.exe	127
PID 2912 wrote to memory of 1908	2912	cmd.exe	128
PID 2912 wrote to memory of 1908	2912	cmd.exe	128
PID 2912 wrote to memory of 1908	2912	cmd.exe	128
PID 3600 wrote to memory of 3936	3600	cmd.exe	133
PID 3600 wrote to memory of 3936	3600	cmd.exe	133
PID 3600 wrote to memory of 3936	3600	cmd.exe	133
PID 4148 wrote to memory of 3576	4148	cmd.exe	134
PID 4148 wrote to memory of 3576	4148	cmd.exe	134
PID 4148 wrote to memory of 3576	4148	cmd.exe	134
PID 3480 wrote to memory of 5936	3480	cmd.exe	139
PID 3480 wrote to memory of 5936	3480	cmd.exe	139
PID 3480 wrote to memory of 5936	3480	cmd.exe	139
PID 1584 wrote to memory of 5036	1584	cmd.exe	140
PID 1584 wrote to memory of 5036	1584	cmd.exe	140
PID 1584 wrote to memory of 5036	1584	cmd.exe	140
PID 5052 wrote to memory of 220	5052	cmd.exe	145
PID 5052 wrote to memory of 220	5052	cmd.exe	145
PID 5052 wrote to memory of 220	5052	cmd.exe	145
PID 5700 wrote to memory of 432	5700	cmd.exe	146
PID 5700 wrote to memory of 432	5700	cmd.exe	146
PID 5700 wrote to memory of 432	5700	cmd.exe	146
PID 1728 wrote to memory of 6116	1728	cmd.exe	151
PID 1728 wrote to memory of 6116	1728	cmd.exe	151
PID 1728 wrote to memory of 6116	1728	cmd.exe	151
PID 3140 wrote to memory of 3052	3140	cmd.exe	152
PID 3140 wrote to memory of 3052	3140	cmd.exe	152
PID 3140 wrote to memory of 3052	3140	cmd.exe	152
PID 4380 wrote to memory of 4328	4380	cmd.exe	157
PID 4380 wrote to memory of 4328	4380	cmd.exe	157
PID 4380 wrote to memory of 4328	4380	cmd.exe	157
PID 4948 wrote to memory of 5412	4948	cmd.exe	158

C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe
"C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" "windows defender.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2808
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:740
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4608
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1548
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4180
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4352
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3880
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1672
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3248
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1808
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4344
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5528
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3968
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3612
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3740
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5496
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5904
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5152
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:408
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4332
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2808
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5172
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3300
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1676
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4000
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3480
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3312
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2812
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3156
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4304
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3832
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2732
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1040
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5216
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3336
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4656
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:60

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4104
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4352
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2808
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6092
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4040
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4940
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3480
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:696
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2188
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4868
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1604
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:780
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5832
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4132
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1948
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5796
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2524
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5688
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4576
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5164
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:64

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3296
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:60

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4512
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5460
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:412
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:936
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5984
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4228
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5148
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5264
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4068
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1600
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5480
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1764
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:680
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:608
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5892
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4584
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4576
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5164
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2588
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2812
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3028
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:452
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3992
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5588
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4556
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1908
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2884
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4476
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4996
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4544
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2140
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4404
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5204
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4472
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:8

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5256
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1804
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4464
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1676
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5936
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2812
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1632
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4932
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1644
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1104
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4656
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3172
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1348
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5504
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1728
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4956
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5968
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3696
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4424
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4940
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6132
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:400
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1696
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3336
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2524
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2548
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2940
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1992
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2404
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2636
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2924
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:916
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1248
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1036
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2288
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3620
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2616
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3052
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5824
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3000
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4632
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6092
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:408
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1584
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4340
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1800
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1896
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3568
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1676
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5212
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4740
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1348
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4984
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4088
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4396
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1940
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1692
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1904
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4892
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5164
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2180
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3296
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4604
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2176
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3584
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4472
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4108
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2256
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5264
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:540
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5292
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3684
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3912
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3716
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\windows defender.exe.log

Filesize
319B

MD5
da4fafeffe21b7cb3a8c170ca7911976

SHA1
50ef77e2451ab60f93f4db88325b897d215be5ad

SHA256
7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7

SHA512
0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows defender.exe

Filesize
37KB

MD5
f9a573b21a7be92000f27a3802bb3518

SHA1
f1d683fa18e0877c057d201e9af7b518ae82c7d0

SHA256
8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce

SHA512
6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334

Download Submit
memory/2428-13-0x00000000746E0000-0x0000000074C91000-memory.dmp

Filesize
5.7MB

Download
memory/2428-14-0x00000000746E0000-0x0000000074C91000-memory.dmp

Filesize
5.7MB

Download
memory/2428-22-0x00000000746E0000-0x0000000074C91000-memory.dmp

Filesize
5.7MB

Download
memory/2428-25-0x00000000746E0000-0x0000000074C91000-memory.dmp

Filesize
5.7MB

Download
memory/2760-0-0x00000000746E2000-0x00000000746E3000-memory.dmp

Filesize
4KB

Download
memory/2760-1-0x00000000746E0000-0x0000000074C91000-memory.dmp

Filesize
5.7MB

Download
memory/2760-2-0x00000000746E0000-0x0000000074C91000-memory.dmp

Filesize
5.7MB

Download
memory/2760-12-0x00000000746E0000-0x0000000074C91000-memory.dmp

Filesize
5.7MB

Download