latentbot | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
14/04/2025, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a573b21a7be92000f27a3802bb3518.exe
Size

37KB
MD5

f9a573b21a7be92000f27a3802bb3518
SHA1

f1d683fa18e0877c057d201e9af7b518ae82c7d0
SHA256

8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce
SHA512

6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334
SSDEEP

384:b/iH4qi0/JZtbH9KyM+2bzmgHvis2gbjrAF+rMRTyN/0L+EcoinblneHQM3epzXW:Li7J95M+2b6g6tgnrM+rMRa8NuKft

Score

10^/10

latentbot njrat hacked defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

holyfuckingshit.zapto.org:1188

Mutex

dbaa10daaecc50e5048d51ecb95a01dd

Attributes

reg_key
dbaa10daaecc50e5048d51ecb95a01dd
splitter
|'|'|

Extracted

Family

latentbot

holyfuckingshit.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2956	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	f9a573b21a7be92000f27a3802bb3518.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbaa10daaecc50e5048d51ecb95a01dd.exe	windows defender.exe

Executes dropped EXE 64 IoCs

pid	Process
4896	windows defender.exe
2328	windows defender.exe
4476	windows defender.exe
3312	windows defender.exe
948	windows defender.exe
6040	windows defender.exe
3196	windows defender.exe
5564	windows defender.exe
220	windows defender.exe
2176	windows defender.exe
5424	windows defender.exe
1992	windows defender.exe
2076	windows defender.exe
900	windows defender.exe
5940	windows defender.exe
1772	windows defender.exe
4428	windows defender.exe
2008	windows defender.exe
2264	windows defender.exe
5352	windows defender.exe
5672	windows defender.exe
1944	windows defender.exe
3920	windows defender.exe
4972	windows defender.exe
2752	windows defender.exe
2104	windows defender.exe
688	windows defender.exe
5360	windows defender.exe
5776	windows defender.exe
1292	windows defender.exe
2684	windows defender.exe
1560	windows defender.exe
3728	windows defender.exe
5888	windows defender.exe
4324	windows defender.exe
540	windows defender.exe
6076	windows defender.exe
5948	windows defender.exe
5620	windows defender.exe
1740	windows defender.exe
1424	windows defender.exe
3844	windows defender.exe
4544	windows defender.exe
5792	windows defender.exe
856	windows defender.exe
5812	windows defender.exe
5124	windows defender.exe
6084	windows defender.exe
4988	windows defender.exe
5864	windows defender.exe
5528	windows defender.exe
4596	windows defender.exe
3976	windows defender.exe
4740	windows defender.exe
5612	windows defender.exe
4748	windows defender.exe
3344	windows defender.exe
1716	windows defender.exe
4664	windows defender.exe
4208	windows defender.exe
3760	windows defender.exe
5188	windows defender.exe
5592	windows defender.exe
4816	windows defender.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dbaa10daaecc50e5048d51ecb95a01dd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows defender.exe\" .."	windows defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows defender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe
4896	windows defender.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	windows defender.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe
Token: 33	4896	windows defender.exe
Token: SeIncBasePriorityPrivilege	4896	windows defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4896	3708	f9a573b21a7be92000f27a3802bb3518.exe	88
PID 3708 wrote to memory of 4896	3708	f9a573b21a7be92000f27a3802bb3518.exe	88
PID 3708 wrote to memory of 4896	3708	f9a573b21a7be92000f27a3802bb3518.exe	88
PID 4896 wrote to memory of 2956	4896	windows defender.exe	91
PID 4896 wrote to memory of 2956	4896	windows defender.exe	91
PID 4896 wrote to memory of 2956	4896	windows defender.exe	91
PID 3868 wrote to memory of 2328	3868	cmd.exe	97
PID 3868 wrote to memory of 2328	3868	cmd.exe	97
PID 3868 wrote to memory of 2328	3868	cmd.exe	97
PID 3896 wrote to memory of 4476	3896	cmd.exe	98
PID 3896 wrote to memory of 4476	3896	cmd.exe	98
PID 3896 wrote to memory of 4476	3896	cmd.exe	98
PID 4204 wrote to memory of 3312	4204	cmd.exe	103
PID 4204 wrote to memory of 3312	4204	cmd.exe	103
PID 4204 wrote to memory of 3312	4204	cmd.exe	103
PID 3704 wrote to memory of 948	3704	cmd.exe	104
PID 3704 wrote to memory of 948	3704	cmd.exe	104
PID 3704 wrote to memory of 948	3704	cmd.exe	104
PID 4636 wrote to memory of 6040	4636	cmd.exe	109
PID 4636 wrote to memory of 6040	4636	cmd.exe	109
PID 4636 wrote to memory of 6040	4636	cmd.exe	109
PID 3768 wrote to memory of 3196	3768	cmd.exe	110
PID 3768 wrote to memory of 3196	3768	cmd.exe	110
PID 3768 wrote to memory of 3196	3768	cmd.exe	110
PID 4704 wrote to memory of 5564	4704	cmd.exe	115
PID 4704 wrote to memory of 5564	4704	cmd.exe	115
PID 4704 wrote to memory of 5564	4704	cmd.exe	115
PID 1764 wrote to memory of 220	1764	cmd.exe	116
PID 1764 wrote to memory of 220	1764	cmd.exe	116
PID 1764 wrote to memory of 220	1764	cmd.exe	116
PID 5040 wrote to memory of 2176	5040	cmd.exe	121
PID 5040 wrote to memory of 2176	5040	cmd.exe	121
PID 5040 wrote to memory of 2176	5040	cmd.exe	121
PID 3188 wrote to memory of 5424	3188	cmd.exe	122
PID 3188 wrote to memory of 5424	3188	cmd.exe	122
PID 3188 wrote to memory of 5424	3188	cmd.exe	122
PID 5772 wrote to memory of 1992	5772	cmd.exe	127
PID 5772 wrote to memory of 1992	5772	cmd.exe	127
PID 5772 wrote to memory of 1992	5772	cmd.exe	127
PID 5752 wrote to memory of 2076	5752	cmd.exe	128
PID 5752 wrote to memory of 2076	5752	cmd.exe	128
PID 5752 wrote to memory of 2076	5752	cmd.exe	128
PID 1252 wrote to memory of 900	1252	cmd.exe	133
PID 1252 wrote to memory of 900	1252	cmd.exe	133
PID 1252 wrote to memory of 900	1252	cmd.exe	133
PID 1872 wrote to memory of 5940	1872	cmd.exe	134
PID 1872 wrote to memory of 5940	1872	cmd.exe	134
PID 1872 wrote to memory of 5940	1872	cmd.exe	134
PID 5436 wrote to memory of 1772	5436	cmd.exe	139
PID 5436 wrote to memory of 1772	5436	cmd.exe	139
PID 5436 wrote to memory of 1772	5436	cmd.exe	139
PID 4536 wrote to memory of 4428	4536	cmd.exe	140
PID 4536 wrote to memory of 4428	4536	cmd.exe	140
PID 4536 wrote to memory of 4428	4536	cmd.exe	140
PID 5296 wrote to memory of 2008	5296	cmd.exe	145
PID 5296 wrote to memory of 2008	5296	cmd.exe	145
PID 5296 wrote to memory of 2008	5296	cmd.exe	145
PID 468 wrote to memory of 2264	468	cmd.exe	146
PID 468 wrote to memory of 2264	468	cmd.exe	146
PID 468 wrote to memory of 2264	468	cmd.exe	146
PID 5960 wrote to memory of 5352	5960	cmd.exe	151
PID 5960 wrote to memory of 5352	5960	cmd.exe	151
PID 5960 wrote to memory of 5352	5960	cmd.exe	151
PID 1212 wrote to memory of 5672	1212	cmd.exe	152

C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe
"C:\Users\Admin\AppData\Local\Temp\f9a573b21a7be92000f27a3802bb3518.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" "windows defender.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:116
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5528
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4464
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4036
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5448
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4128
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:2684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4344
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2524
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1636
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2904
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3216
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5068
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4508
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1460
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:1424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4620
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5380
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5260
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4028
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3860
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:6084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5288
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3196
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5252
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2124
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5508
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4128
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:444
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:3760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5416
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:720
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4324
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:5592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2680
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - Executes dropped EXE
  PID:4816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3680
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1992
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6036
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3988
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3844
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:6128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2360
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4268
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:828
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1756
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3688
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3216
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:688
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2628
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3108
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3672
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1724
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1340
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6064
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:668
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4576
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4028
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1600
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6108
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2336
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:8
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1924
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1856
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:64
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5444
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2756
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4300
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:560
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5128
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5740
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2124
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3096
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2416
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4780
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5584
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3316
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1712
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5280
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4312
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4800
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2212
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:860
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4500
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5756
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4056
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4176
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5024
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5684
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4300
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5092
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4420
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2720
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1516
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5016
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:632
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4596
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6060
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5652
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5136
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:704
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4456
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5356
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5384
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:388
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4800
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4924
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2764
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2964
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5756
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:972
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4176
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4844
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5332
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3268
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1080
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1312
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5680
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2044
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2124
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5076
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2488
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6052
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1636
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5796
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:720
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5352
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3624
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4948
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2224
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4504
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5840
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3676
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3864
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4620
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5772
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5284
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:856
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2696
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4072
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2732
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1544
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5816
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5132
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5800
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4832
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:668
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5440
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5984
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2248
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4972
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3328
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5536
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1652
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1424
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5320
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4480
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2460
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5652
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5844
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5280
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2164
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1536
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4768
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:896
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5100
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5088
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:928
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3888
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3900
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2636
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4616
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3148
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5800
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5848
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5000
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4472
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3708
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4160
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4660
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4812
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1652
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6112
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5272
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5320
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4272
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1752
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4552
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3804
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2640
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:2376
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4960
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:8
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6088
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4728
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4508
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:6108
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:2488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5564
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4644
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4892
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4300
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1604
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3976
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5676
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1012
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5428
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5140
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:3544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:4484
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:1120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\windows defender.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
  2⤵
  PID:5500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:1208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows defender.exe" ..
1⤵
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\windows defender.exe.log

Filesize
319B

MD5
cdab7719c71b2844a3e7ff9e41894b8a

SHA1
8e6e0e55695e468eb3c237f21340c9d30cab922c

SHA256
e84a57ed5465aaca393476f6271a2413dddad154cbae40827c4639bfc0b3e3eb

SHA512
ec92e8fc3ce02336eea401f9db823ac0a2ad87bb41130f493e72f3c5ca100a461d6296a710afcc93e1fe1fc8630c5e0029e17f58583520077a3c80ad794d9dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows defender.exe

Filesize
37KB

MD5
f9a573b21a7be92000f27a3802bb3518

SHA1
f1d683fa18e0877c057d201e9af7b518ae82c7d0

SHA256
8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce

SHA512
6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334

Download Submit
memory/3708-0-0x0000000074C22000-0x0000000074C23000-memory.dmp

Filesize
4KB

Download
memory/3708-1-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/3708-2-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/3708-5-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/4896-6-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/4896-7-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/4896-14-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download