latentbot | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
14/04/2025, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a573b21a7be92000f27a3802bb3518.exe
Size

37KB
MD5

f9a573b21a7be92000f27a3802bb3518
SHA1

f1d683fa18e0877c057d201e9af7b518ae82c7d0
SHA256

8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce
SHA512

6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334
SSDEEP

384:b/iH4qi0/JZtbH9KyM+2bzmgHvis2gbjrAF+rMRTyN/0L+EcoinblneHQM3epzXW:Li7J95M+2b6g6tgnrM+rMRa8NuKft

Score

10^/10

latentbot defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

latentbot

holyfuckingshit.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4680	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe

Executes dropped EXE 64 IoCs

pid	Process
4720	windows defender.exe
4612	windows defender.exe
4164	windows defender.exe
4396	windows defender.exe
1040	windows defender.exe
2356	windows defender.exe
3308	windows defender.exe
5072	windows defender.exe
1364	windows defender.exe
4512	windows defender.exe
980	windows defender.exe
5232	windows defender.exe
4904	windows defender.exe
3840	windows defender.exe
4076	windows defender.exe
5676	windows defender.exe
3108	windows defender.exe
2168	windows defender.exe
1948	windows defender.exe
1288	windows defender.exe
3136	windows defender.exe
1464	windows defender.exe
5744	windows defender.exe
6140	windows defender.exe
444	windows defender.exe
2784	windows defender.exe
2060	windows defender.exe
2760	windows defender.exe
3980	windows defender.exe
3168	windows defender.exe
5408	windows defender.exe
1220	windows defender.exe
2720	windows defender.exe
5776	windows defender.exe
2352	windows defender.exe
2344	windows defender.exe
5052	windows defender.exe
2928	windows defender.exe
2256	windows defender.exe
5076	windows defender.exe
4324	windows defender.exe
5104	windows defender.exe
4424	windows defender.exe
5140	windows defender.exe
5132	windows defender.exe
4288	windows defender.exe
5096	windows defender.exe
5012	windows defender.exe
3568	windows defender.exe
1572	windows defender.exe
1556	windows defender.exe
4780	windows defender.exe
1800	windows defender.exe
3820	windows defender.exe
1376	windows defender.exe
1408	windows defender.exe
2640	windows defender.exe
5992	windows defender.exe
244	windows defender.exe
5672	windows defender.exe
428	windows defender.exe
2644	windows defender.exe
904	windows defender.exe
4972	windows defender.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe
4720	windows defender.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4720	windows defender.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe
Token: 33	4720	windows defender.exe
Token: SeIncBasePriorityPrivilege	4720	windows defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4720	1876	f9a573b21a7be92000f27a3802bb3518.exe	78
PID 1876 wrote to memory of 4720	1876	f9a573b21a7be92000f27a3802bb3518.exe	78
PID 1876 wrote to memory of 4720	1876	f9a573b21a7be92000f27a3802bb3518.exe	78
PID 4720 wrote to memory of 4680	4720	windows defender.exe	79
PID 4720 wrote to memory of 4680	4720	windows defender.exe	79
PID 4720 wrote to memory of 4680	4720	windows defender.exe	79
PID 4084 wrote to memory of 4612	4084	cmd.exe	85
PID 4084 wrote to memory of 4612	4084	cmd.exe	85
PID 4084 wrote to memory of 4612	4084	cmd.exe	85
PID 2872 wrote to memory of 4164	2872	cmd.exe	86
PID 2872 wrote to memory of 4164	2872	cmd.exe	86
PID 2872 wrote to memory of 4164	2872	cmd.exe	86
PID 3848 wrote to memory of 4396	3848	cmd.exe	91
PID 3848 wrote to memory of 4396	3848	cmd.exe	91
PID 3848 wrote to memory of 4396	3848	cmd.exe	91
PID 2928 wrote to memory of 1040	2928	cmd.exe	92
PID 2928 wrote to memory of 1040	2928	cmd.exe	92
PID 2928 wrote to memory of 1040	2928	cmd.exe	92
PID 5112 wrote to memory of 2356	5112	cmd.exe	97
PID 5112 wrote to memory of 2356	5112	cmd.exe	97
PID 5112 wrote to memory of 2356	5112	cmd.exe	97
PID 5068 wrote to memory of 3308	5068	cmd.exe	98
PID 5068 wrote to memory of 3308	5068	cmd.exe	98
PID 5068 wrote to memory of 3308	5068	cmd.exe	98
PID 200 wrote to memory of 5072	200	cmd.exe	103
PID 200 wrote to memory of 5072	200	cmd.exe	103
PID 200 wrote to memory of 5072	200	cmd.exe	103
PID 5788 wrote to memory of 1364	5788	cmd.exe	104
PID 5788 wrote to memory of 1364	5788	cmd.exe	104
PID 5788 wrote to memory of 1364	5788	cmd.exe	104
PID 4548 wrote to memory of 4512	4548	cmd.exe	109
PID 4548 wrote to memory of 4512	4548	cmd.exe	109
PID 4548 wrote to memory of 4512	4548	cmd.exe	109
PID 3804 wrote to memory of 980	3804	cmd.exe	110
PID 3804 wrote to memory of 980	3804	cmd.exe	110
PID 3804 wrote to memory of 980	3804	cmd.exe	110
PID 2828 wrote to memory of 5232	2828	cmd.exe	115
PID 2828 wrote to memory of 5232	2828	cmd.exe	115
PID 2828 wrote to memory of 5232	2828	cmd.exe	115
PID 5692 wrote to memory of 4904	5692	cmd.exe	116
PID 5692 wrote to memory of 4904	5692	cmd.exe	116
PID 5692 wrote to memory of 4904	5692	cmd.exe	116
PID 5012 wrote to memory of 3840	5012	cmd.exe	121
PID 5012 wrote to memory of 3840	5012	cmd.exe	121
PID 5012 wrote to memory of 3840	5012	cmd.exe	121
PID 4392 wrote to memory of 4076	4392	cmd.exe	122
PID 4392 wrote to memory of 4076	4392	cmd.exe	122
PID 4392 wrote to memory of 4076	4392	cmd.exe	122
PID 4872 wrote to memory of 5676	4872	cmd.exe	127
PID 4872 wrote to memory of 5676	4872	cmd.exe	127
PID 4872 wrote to memory of 5676	4872	cmd.exe	127
PID 848 wrote to memory of 3108	848	cmd.exe	128
PID 848 wrote to memory of 3108	848	cmd.exe	128
PID 848 wrote to memory of 3108	848	cmd.exe	128
PID 3580 wrote to memory of 2168	3580	cmd.exe	133
PID 3580 wrote to memory of 2168	3580	cmd.exe	133
PID 3580 wrote to memory of 2168	3580	cmd.exe	133
PID 472 wrote to memory of 1948	472	cmd.exe	134
PID 472 wrote to memory of 1948	472	cmd.exe	134
PID 472 wrote to memory of 1948	472	cmd.exe	134
PID 3820 wrote to memory of 1288	3820	cmd.exe	139
PID 3820 wrote to memory of 1288	3820	cmd.exe	139
PID 3820 wrote to memory of 1288	3820	cmd.exe	139
PID 5656 wrote to memory of 3136	5656	cmd.exe	140

C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe
"C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" "windows defender.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:200
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:8
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1408
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3188
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5700
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3540
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4592
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:576
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4776
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5612
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4692
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3832
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1036
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5072
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1052
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2368
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:692
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4048
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4840
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6072
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1696
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5464
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3120
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1972
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5512
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2736
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6124
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:788
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5160
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1496
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2716
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1728
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5560
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4536
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5052
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2256
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4620
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4908
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1500
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4656
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4688
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5804
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:748
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1144
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:104
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4792
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3116
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6072
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:324
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5656
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4664
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4196
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5460
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6140
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2948
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5416
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2364
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4492
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5408
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2500
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3028
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2268
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4416
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1604
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4896
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5244
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4216
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6032
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4424
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3008
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5148
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5232
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6016
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5628
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5424
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4280
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3956
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5328
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4196
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5020
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3344
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4996
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3984
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1820
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6040
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1160
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4532
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5016
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1880
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4092
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4168
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3668
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5144
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5412
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3040
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3572
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1572
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4744
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1008
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5464
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5732
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1544
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5740
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5240
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5856
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4972
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5292
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1000
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2936
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1348
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5276
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4292
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5028
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3648
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5760
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5132
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4904
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5032
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4132
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3008
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6140
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:236
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4556
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2324
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5312
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4676
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:944
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3104
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2884
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1916
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4424
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5096
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4932
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4288
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1692
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4104
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3116
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:752
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2180
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3824
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5612
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2932
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3340
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4440
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:236
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:404
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1332
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1548
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5208
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:980
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4424
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1348
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2296
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5592
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5016
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3116
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:940
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4780
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4796
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2436
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:328
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3192
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3044
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1040
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3340
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2720
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2924
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3672
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:492
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\windows defender.exe.log

Filesize
319B

MD5
2a0834560ed3770fc33d7a42f8229722

SHA1
c8c85f989e7a216211cf9e4ce90b0cc95354aa53

SHA256
8aa2d836004258f1a1195dc4a96215b685aed0c46a261a2860625d424e9402b6

SHA512
c5b64d84e57eb8cc387b5feedf7719f1f7ae21f6197169f5f73bc86deddb538b9af3c9952c94c4f69ae956e1656d11ab7441c292d2d850a4d2aaa9ec678f8e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows defender.exe

Filesize
37KB

MD5
f9a573b21a7be92000f27a3802bb3518

SHA1
f1d683fa18e0877c057d201e9af7b518ae82c7d0

SHA256
8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce

SHA512
6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334

Download Submit
memory/1876-0-0x0000000074D81000-0x0000000074D82000-memory.dmp

Filesize
4KB

Download
memory/1876-1-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/1876-2-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/1876-12-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/4720-13-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/4720-14-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/4720-15-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/4720-23-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/4720-24-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/4720-25-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download