latentbot | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
900s
max time network
897s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a573b21a7be92000f27a3802bb3518.exe
Size

37KB
MD5

f9a573b21a7be92000f27a3802bb3518
SHA1

f1d683fa18e0877c057d201e9af7b518ae82c7d0
SHA256

8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce
SHA512

6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334
SSDEEP

384:b/iH4qi0/JZtbH9KyM+2bzmgHvis2gbjrAF+rMRTyN/0L+EcoinblneHQM3epzXW:Li7J95M+2b6g6tgnrM+rMRa8NuKft

Score

10^/10

latentbot defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

latentbot

holyfuckingshit.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5136	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	f9a573b21a7be92000f27a3802bb3518.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe

Executes dropped EXE 64 IoCs

pid	Process
6100	windows defender.exe
3472	windows defender.exe
4172	windows defender.exe
6128	windows defender.exe
2276	windows defender.exe
980	windows defender.exe
2292	windows defender.exe
456	windows defender.exe
4452	windows defender.exe
5820	windows defender.exe
2008	windows defender.exe
528	windows defender.exe
2988	windows defender.exe
5444	windows defender.exe
5732	windows defender.exe
2340	windows defender.exe
2960	windows defender.exe
5092	windows defender.exe
4620	windows defender.exe
5000	windows defender.exe
2512	windows defender.exe
4316	windows defender.exe
1112	windows defender.exe
2004	windows defender.exe
1884	windows defender.exe
6064	windows defender.exe
5396	windows defender.exe
3840	windows defender.exe
3992	windows defender.exe
1712	windows defender.exe
1420	windows defender.exe
5016	windows defender.exe
4864	windows defender.exe
4992	windows defender.exe
6024	windows defender.exe
5484	windows defender.exe
4116	windows defender.exe
5092	windows defender.exe
4820	windows defender.exe
3348	windows defender.exe
2812	windows defender.exe
3476	windows defender.exe
4844	windows defender.exe
3060	windows defender.exe
3984	windows defender.exe
1672	windows defender.exe
4612	windows defender.exe
4404	windows defender.exe
3792	windows defender.exe
4084	windows defender.exe
2868	windows defender.exe
748	windows defender.exe
840	windows defender.exe
2692	windows defender.exe
1336	windows defender.exe
5020	windows defender.exe
6052	windows defender.exe
4044	windows defender.exe
3676	windows defender.exe
4152	windows defender.exe
2044	windows defender.exe
5036	windows defender.exe
5708	windows defender.exe
5548	windows defender.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe
6100	windows defender.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6100	windows defender.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe
Token: SeIncBasePriorityPrivilege	6100	windows defender.exe
Token: 33	6100	windows defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 6100	1700	f9a573b21a7be92000f27a3802bb3518.exe	99
PID 1700 wrote to memory of 6100	1700	f9a573b21a7be92000f27a3802bb3518.exe	99
PID 1700 wrote to memory of 6100	1700	f9a573b21a7be92000f27a3802bb3518.exe	99
PID 6100 wrote to memory of 5136	6100	windows defender.exe	102
PID 6100 wrote to memory of 5136	6100	windows defender.exe	102
PID 6100 wrote to memory of 5136	6100	windows defender.exe	102
PID 5272 wrote to memory of 3472	5272	cmd.exe	108
PID 5272 wrote to memory of 3472	5272	cmd.exe	108
PID 5272 wrote to memory of 3472	5272	cmd.exe	108
PID 5656 wrote to memory of 4172	5656	cmd.exe	109
PID 5656 wrote to memory of 4172	5656	cmd.exe	109
PID 5656 wrote to memory of 4172	5656	cmd.exe	109
PID 2028 wrote to memory of 6128	2028	cmd.exe	114
PID 2028 wrote to memory of 6128	2028	cmd.exe	114
PID 2028 wrote to memory of 6128	2028	cmd.exe	114
PID 3840 wrote to memory of 2276	3840	cmd.exe	115
PID 3840 wrote to memory of 2276	3840	cmd.exe	115
PID 3840 wrote to memory of 2276	3840	cmd.exe	115
PID 2768 wrote to memory of 2292	2768	cmd.exe	120
PID 2768 wrote to memory of 2292	2768	cmd.exe	120
PID 2768 wrote to memory of 2292	2768	cmd.exe	120
PID 232 wrote to memory of 980	232	cmd.exe	121
PID 232 wrote to memory of 980	232	cmd.exe	121
PID 232 wrote to memory of 980	232	cmd.exe	121
PID 4864 wrote to memory of 456	4864	cmd.exe	127
PID 4864 wrote to memory of 456	4864	cmd.exe	127
PID 4864 wrote to memory of 456	4864	cmd.exe	127
PID 3780 wrote to memory of 4452	3780	cmd.exe	126
PID 3780 wrote to memory of 4452	3780	cmd.exe	126
PID 3780 wrote to memory of 4452	3780	cmd.exe	126
PID 816 wrote to memory of 5820	816	cmd.exe	132
PID 816 wrote to memory of 5820	816	cmd.exe	132
PID 816 wrote to memory of 5820	816	cmd.exe	132
PID 6012 wrote to memory of 2008	6012	cmd.exe	133
PID 6012 wrote to memory of 2008	6012	cmd.exe	133
PID 6012 wrote to memory of 2008	6012	cmd.exe	133
PID 2928 wrote to memory of 528	2928	cmd.exe	138
PID 2928 wrote to memory of 528	2928	cmd.exe	138
PID 2928 wrote to memory of 528	2928	cmd.exe	138
PID 4384 wrote to memory of 2988	4384	cmd.exe	139
PID 4384 wrote to memory of 2988	4384	cmd.exe	139
PID 4384 wrote to memory of 2988	4384	cmd.exe	139
PID 4884 wrote to memory of 5444	4884	cmd.exe	144
PID 4884 wrote to memory of 5444	4884	cmd.exe	144
PID 4884 wrote to memory of 5444	4884	cmd.exe	144
PID 2044 wrote to memory of 5732	2044	cmd.exe	145
PID 2044 wrote to memory of 5732	2044	cmd.exe	145
PID 2044 wrote to memory of 5732	2044	cmd.exe	145
PID 3748 wrote to memory of 2340	3748	cmd.exe	150
PID 3748 wrote to memory of 2340	3748	cmd.exe	150
PID 3748 wrote to memory of 2340	3748	cmd.exe	150
PID 4192 wrote to memory of 2960	4192	cmd.exe	151
PID 4192 wrote to memory of 2960	4192	cmd.exe	151
PID 4192 wrote to memory of 2960	4192	cmd.exe	151
PID 3236 wrote to memory of 5092	3236	cmd.exe	156
PID 3236 wrote to memory of 5092	3236	cmd.exe	156
PID 3236 wrote to memory of 5092	3236	cmd.exe	156
PID 1184 wrote to memory of 4620	1184	cmd.exe	157
PID 1184 wrote to memory of 4620	1184	cmd.exe	157
PID 1184 wrote to memory of 4620	1184	cmd.exe	157
PID 4968 wrote to memory of 5000	4968	cmd.exe	162
PID 4968 wrote to memory of 5000	4968	cmd.exe	162
PID 4968 wrote to memory of 5000	4968	cmd.exe	162
PID 4952 wrote to memory of 2512	4952	cmd.exe	163

C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe
"C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" "windows defender.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4752
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5156
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4404
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1652
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4720
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5860
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4924
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5392
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2464
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5148
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1476
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5388
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4644
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5116
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5968
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2924
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1808
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2508
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1596
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4048
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4804
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5892
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3568
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3944
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5584
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3168
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6088
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2248
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5900
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1028
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4756
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2844
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:532
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3024
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3268
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5588
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3580
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1904
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5952
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5088
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2328
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3756
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3956
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4364
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5444
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:868
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4880
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5096
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1936
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4672
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6000
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3352
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1668
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3024
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5356
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4720
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3580
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5436
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1568
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5172
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:8
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4536
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4228
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4808
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2920
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4716
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1140
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5448
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4132
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4632
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5520
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3532
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4612
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5368
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2528
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5692
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5172
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6020
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4476
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5620
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5156
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4852
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2304
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1672
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4716
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5052
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3996
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3740
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4776
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5312
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5224
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1736
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1988
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5032
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4476
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:60
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2412
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4732
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2728
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5000
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5436
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4208
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5964
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:436
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6020
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4556
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2024
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1608
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2924
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4876
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5968
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5092
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3348
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:680
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4636
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5584
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1948
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4760
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4596
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3932
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:620
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4972
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:532
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:892
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5372
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:60
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1896
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5528
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3156
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5840
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2396
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:636
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3172
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4884
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1160
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5156
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5224
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5692
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2216
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4992
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2468
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3528
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:8

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5296
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2804
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5404
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3020
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2396
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5016
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2464
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4760
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4408
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4108
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5536
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2388
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4908
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3824
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2020
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4792
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4644
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4532
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1392
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5688
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3004
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4716
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4776
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:512
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6024
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4912
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4604
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:868
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4880
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4504
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2532
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4488
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5148
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3580
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2664
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2152
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5156
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5324
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5132
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4072
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3292
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3668
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6000
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:432
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3748
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3352
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2596
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5452
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2520
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6020
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2728
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4956
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2532
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2440
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4488
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4352
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4784
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3036
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5404
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3364
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5596
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3228
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2128
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4916
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4092
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4600
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1596
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:904
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1400
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3440
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3800
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2572
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5464
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:892
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1528
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4452
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:8
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4716
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4040
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:512
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4500
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2320
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1840
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4680
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3776
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4916
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2820
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5680
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4272
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4512
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3092
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3168
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4192
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4356
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1528
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6108
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2900
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5448
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2664
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1896
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2260
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3820
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5908
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2388
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6068
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1296
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5596
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5356
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4852
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:860
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5832
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3780
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4988
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3004
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2604
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3892
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6140
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6128
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4088
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5632
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2432
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6084
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1416
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5260
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1896
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5836
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2396
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4556
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4696
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5460
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2412
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5356
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3792
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3800
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3780
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2572
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5548
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4144
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:840
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5812
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5476
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5108
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5468
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4088
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4020
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3572
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1784
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2736
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4696
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5460
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3972
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3948
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:180
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4436
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3268
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3476
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4172
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5592
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1912
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1840
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5760
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4764
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4684
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3308
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\windows defender.exe.log

Filesize
319B

MD5
da4fafeffe21b7cb3a8c170ca7911976

SHA1
50ef77e2451ab60f93f4db88325b897d215be5ad

SHA256
7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7

SHA512
0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows defender.exe

Filesize
37KB

MD5
f9a573b21a7be92000f27a3802bb3518

SHA1
f1d683fa18e0877c057d201e9af7b518ae82c7d0

SHA256
8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce

SHA512
6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334

Download Submit
memory/1700-0-0x0000000075032000-0x0000000075033000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x0000000075030000-0x00000000755E1000-memory.dmp

Filesize
5.7MB

Download
memory/1700-2-0x0000000075030000-0x00000000755E1000-memory.dmp

Filesize
5.7MB

Download
memory/1700-12-0x0000000075030000-0x00000000755E1000-memory.dmp

Filesize
5.7MB

Download
memory/6100-13-0x0000000075030000-0x00000000755E1000-memory.dmp

Filesize
5.7MB

Download
memory/6100-14-0x0000000075030000-0x00000000755E1000-memory.dmp

Filesize
5.7MB

Download
memory/6100-24-0x0000000075030000-0x00000000755E1000-memory.dmp

Filesize
5.7MB

Download