b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a

Analysis

max time kernel
63s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/03/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat
Size 251B
Sample260331-mz9snact7x
SHA256 b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a
MD5 fe27e510850f077e970a158a1a7b4103
SHA1 d4346b246e56f3d15e24fe30b91f989ac243e252
SHA512 753d95960213d013c51b9c4f983c18e74a30a6fd413787781d2a5dede65f11717d6b5984dc42244cb04be33b834893bb82ebf6ce5cbd61ffd10fb79755cbff2c
TLSH
T1FCD0974B11240066CAB4CAA412AE7302AE4B312710032D9A322F543A7F180B3C2DA098
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
19	1084	Process not Found
22	1084	Process not Found
24	1084	Process not Found
25	1084	Process not Found
27	1084	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4852	powershell.exe
3388	powershell.exe
4916	powershell.exe
4644	powershell.exe
4872	powershell.exe
1776	powershell.exe
5524	powershell.exe
2196	powershell.exe
2916	powershell.exe
636	powershell.exe
3080	powershell.exe
5352	powershell.exe
5612	powershell.exe
2160	powershell.exe
6036	powershell.exe
6104	powershell.exe
6096	powershell.exe
4392	powershell.exe
4268	powershell.exe
5788	powershell.exe
5228	powershell.exe
1956	powershell.exe
4064	powershell.exe
4772	powershell.exe
2280	powershell.exe
2716	powershell.exe
5260	powershell.exe
4720	powershell.exe
3788	powershell.exe
2332	powershell.exe
4808	powershell.exe
3456	powershell.exe
4992	powershell.exe
4744	powershell.exe
5608	powershell.exe
5536	powershell.exe
5052	powershell.exe
4584	powershell.exe
4804	powershell.exe
4216	powershell.exe
5416	powershell.exe
4196	powershell.exe
4400	powershell.exe
4580	powershell.exe
5508	powershell.exe
4880	powershell.exe
2888	powershell.exe
5196	powershell.exe
2856	powershell.exe
2000	powershell.exe
3016	powershell.exe
3748	powershell.exe
2800	powershell.exe
4044	powershell.exe
5128	powershell.exe
5320	powershell.exe
4912	powershell.exe
2876	powershell.exe
5892	powershell.exe
5024	powershell.exe
5252	powershell.exe
5584	powershell.exe
4964	powershell.exe
4712	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2196	powershell.exe
2196	powershell.exe
3784	powershell.exe
3784	powershell.exe
3876	powershell.exe
3876	powershell.exe
2544	powershell.exe
2544	powershell.exe
1052	powershell.exe
1052	powershell.exe
4608	powershell.exe
4608	powershell.exe
2156	powershell.exe
2156	powershell.exe
3156	powershell.exe
3156	powershell.exe
4644	powershell.exe
4644	powershell.exe
3964	powershell.exe
3964	powershell.exe
3976	powershell.exe
3976	powershell.exe
4324	powershell.exe
4324	powershell.exe
4184	powershell.exe
4184	powershell.exe
3820	powershell.exe
3820	powershell.exe
2916	powershell.exe
2916	powershell.exe
5116	powershell.exe
5116	powershell.exe
3044	powershell.exe
3044	powershell.exe
2856	powershell.exe
2856	powershell.exe
520	powershell.exe
520	powershell.exe
560	powershell.exe
560	powershell.exe
2000	powershell.exe
2000	powershell.exe
4196	powershell.exe
4196	powershell.exe
1708	powershell.exe
1708	powershell.exe
1428	powershell.exe
1428	powershell.exe
4788	powershell.exe
4788	powershell.exe
880	powershell.exe
880	powershell.exe
2296	powershell.exe
2296	powershell.exe
2920	powershell.exe
2920	powershell.exe
1288	powershell.exe
1288	powershell.exe
1312	powershell.exe
1312	powershell.exe
3564	powershell.exe
3564	powershell.exe
2028	powershell.exe
2028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	204	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2196	3848	cmd.exe	85
PID 2196 wrote to memory of 1424	2196	powershell.exe	86
PID 1424 wrote to memory of 3784	1424	cmd.exe	89
PID 3784 wrote to memory of 5036	3784	powershell.exe	90
PID 5036 wrote to memory of 3876	5036	cmd.exe	92
PID 3876 wrote to memory of 4520	3876	powershell.exe	93
PID 4520 wrote to memory of 2544	4520	cmd.exe	95
PID 2544 wrote to memory of 5032	2544	powershell.exe	96
PID 5032 wrote to memory of 1052	5032	cmd.exe	98
PID 1052 wrote to memory of 3048	1052	powershell.exe	99
PID 3048 wrote to memory of 4608	3048	cmd.exe	101
PID 4608 wrote to memory of 1164	4608	powershell.exe	102
PID 1164 wrote to memory of 2156	1164	cmd.exe	104
PID 2156 wrote to memory of 4676	2156	powershell.exe	105
PID 4676 wrote to memory of 3156	4676	cmd.exe	107
PID 3156 wrote to memory of 4752	3156	powershell.exe	108
PID 4752 wrote to memory of 4644	4752	cmd.exe	110
PID 4644 wrote to memory of 5100	4644	powershell.exe	111
PID 5100 wrote to memory of 3964	5100	cmd.exe	113
PID 3964 wrote to memory of 1216	3964	powershell.exe	114
PID 1216 wrote to memory of 3976	1216	cmd.exe	116
PID 3976 wrote to memory of 2744	3976	powershell.exe	117
PID 2744 wrote to memory of 4324	2744	cmd.exe	119
PID 4324 wrote to memory of 4504	4324	powershell.exe	120
PID 4504 wrote to memory of 4184	4504	cmd.exe	122
PID 4184 wrote to memory of 3668	4184	powershell.exe	123
PID 3668 wrote to memory of 3820	3668	cmd.exe	126
PID 3820 wrote to memory of 2508	3820	powershell.exe	127
PID 2508 wrote to memory of 2916	2508	cmd.exe	129
PID 2916 wrote to memory of 1652	2916	powershell.exe	130
PID 1652 wrote to memory of 5116	1652	cmd.exe	132
PID 5116 wrote to memory of 2220	5116	powershell.exe	133
PID 2220 wrote to memory of 3044	2220	cmd.exe	135
PID 3044 wrote to memory of 2232	3044	powershell.exe	136
PID 2232 wrote to memory of 2856	2232	cmd.exe	138
PID 2856 wrote to memory of 1080	2856	powershell.exe	139
PID 1080 wrote to memory of 520	1080	cmd.exe	141
PID 520 wrote to memory of 2316	520	powershell.exe	142
PID 2316 wrote to memory of 560	2316	cmd.exe	144
PID 560 wrote to memory of 2412	560	powershell.exe	145
PID 2412 wrote to memory of 2000	2412	cmd.exe	149
PID 2000 wrote to memory of 5008	2000	powershell.exe	150
PID 5008 wrote to memory of 4196	5008	cmd.exe	152
PID 4196 wrote to memory of 4448	4196	powershell.exe	153
PID 4448 wrote to memory of 1708	4448	cmd.exe	156
PID 1708 wrote to memory of 740	1708	powershell.exe	158
PID 740 wrote to memory of 1428	740	cmd.exe	160
PID 1428 wrote to memory of 2568	1428	powershell.exe	161
PID 2568 wrote to memory of 4788	2568	cmd.exe	163
PID 4788 wrote to memory of 3960	4788	powershell.exe	164
PID 3960 wrote to memory of 880	3960	cmd.exe	166
PID 880 wrote to memory of 4136	880	powershell.exe	167
PID 4136 wrote to memory of 2296	4136	cmd.exe	169
PID 2296 wrote to memory of 4000	2296	powershell.exe	170
PID 4000 wrote to memory of 2920	4000	cmd.exe	172
PID 2920 wrote to memory of 4568	2920	powershell.exe	173
PID 4568 wrote to memory of 1288	4568	cmd.exe	175
PID 1288 wrote to memory of 2312	1288	powershell.exe	177
PID 2312 wrote to memory of 1312	2312	cmd.exe	179
PID 1312 wrote to memory of 3936	1312	powershell.exe	180
PID 3936 wrote to memory of 3564	3936	cmd.exe	182
PID 3564 wrote to memory of 1856	3564	powershell.exe	183
PID 1856 wrote to memory of 2028	1856	cmd.exe	185
PID 2028 wrote to memory of 4460	2028	powershell.exe	186

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        7⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        12⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        14⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        16⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        17⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        18⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        19⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        20⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        21⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        22⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        24⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        26⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        27⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        28⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        30⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        32⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        33⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        34⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        35⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        36⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        37⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        38⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        39⤵
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        40⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        41⤵
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        42⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        43⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        44⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        45⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        46⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        47⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        48⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        49⤵
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        50⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        51⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        52⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        53⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        54⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        55⤵
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        56⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        57⤵
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        58⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        59⤵
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        60⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        61⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        62⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        63⤵
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        64⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        65⤵
        
        PID:4460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        66⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        67⤵
        Modifies registry class
        
        PID:4380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        68⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        69⤵
        Modifies registry class
        
        PID:2844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        70⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        71⤵
        Modifies registry class
        
        PID:2852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        72⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        73⤵
        Modifies registry class
        
        PID:4976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        74⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        75⤵
        Modifies registry class
        
        PID:1496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        76⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:60
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        77⤵
        
        PID:3164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        78⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        79⤵
        
        PID:2564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        80⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        81⤵
        Modifies registry class
        
        PID:4248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        82⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        83⤵
        Modifies registry class
        
        PID:4296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        84⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        85⤵
        Modifies registry class
        
        PID:4300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        86⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        87⤵
        
        PID:1788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        88⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        89⤵
        
        PID:2636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        90⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        91⤵
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        92⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        93⤵
        Modifies registry class
        
        PID:4072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        94⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        95⤵
        Modifies registry class
        
        PID:2348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        96⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        97⤵
        Modifies registry class
        
        PID:4796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        98⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        99⤵
        
        PID:3212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        100⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        101⤵
        
        PID:3816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        102⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        103⤵
        Modifies registry class
        
        PID:4276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        104⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        105⤵
        Modifies registry class
        
        PID:4372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        106⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        107⤵
        
        PID:4424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        108⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        109⤵
        Modifies registry class
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        110⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        111⤵
        Modifies registry class
        
        PID:2236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        112⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        113⤵
        Modifies registry class
        
        PID:3192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        114⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        115⤵
        
        PID:3920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        116⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        117⤵
        Modifies registry class
        
        PID:968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        118⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        119⤵
        Modifies registry class
        
        PID:3356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        120⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        121⤵
        
        PID:4556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        122⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        123⤵
        Modifies registry class
        
        PID:4528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        124⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        125⤵
        
        PID:3008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        126⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        127⤵
        Modifies registry class
        
        PID:2164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        128⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        129⤵
        
        PID:2596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        130⤵
        
        PID:4456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        131⤵
        
        PID:2436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        132⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        133⤵
        
        PID:4292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        134⤵
        
        PID:4004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        135⤵
        Modifies registry class
        
        PID:3400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        136⤵
        
        PID:1156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        137⤵
        
        PID:4540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        138⤵
        
        PID:2960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        139⤵
        
        PID:1084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        140⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        141⤵
        Modifies registry class
        
        PID:3912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        142⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        143⤵
        
        PID:4304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        144⤵
        
        PID:4180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        145⤵
        Modifies registry class
        
        PID:2112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        146⤵
        
        PID:4356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        147⤵
        
        PID:620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        148⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        149⤵
        Modifies registry class
        
        PID:1320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        150⤵
        
        PID:2120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        151⤵
        Modifies registry class
        
        PID:1268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        152⤵
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        153⤵
        
        PID:3992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        154⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        155⤵
        
        PID:4164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        156⤵
        
        PID:2036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        157⤵
        Modifies registry class
        
        PID:3332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        158⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        159⤵
        Modifies registry class
        
        PID:2592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        160⤵
        
        PID:2272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        161⤵
        
        PID:4428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        162⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        163⤵
        Modifies registry class
        
        PID:1528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        164⤵
        
        PID:3832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        165⤵
        Modifies registry class
        
        PID:3448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        166⤵
        
        PID:2084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        167⤵
        
        PID:2192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        168⤵
        
        PID:3284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        169⤵
        
        PID:4412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        170⤵
        
        PID:2388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        171⤵
        Modifies registry class
        
        PID:3824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        172⤵
        
        PID:1844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        173⤵
        Modifies registry class
        
        PID:408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        174⤵
        
        PID:2644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        175⤵
        
        PID:4544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        176⤵
        
        PID:4736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        177⤵
        
        PID:1196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        178⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        179⤵
        
        PID:2416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        180⤵
        
        PID:2548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        181⤵
        Modifies registry class
        
        PID:1584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        182⤵
        
        PID:1884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        183⤵
        Modifies registry class
        
        PID:1128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        184⤵
        
        PID:4984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        185⤵
        
        PID:4616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        186⤵
        
        PID:4048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        187⤵
        Modifies registry class
        
        PID:1228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        188⤵
        
        PID:1064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        189⤵
        
        PID:4848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        190⤵
        
        PID:1028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        191⤵
        Modifies registry class
        
        PID:2580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        192⤵
        
        PID:3676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        193⤵
        Modifies registry class
        
        PID:4472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        194⤵
        
        PID:1300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        195⤵
        
        PID:1904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        196⤵
        
        PID:1504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        197⤵
        
        PID:1896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        198⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        199⤵
        Modifies registry class
        
        PID:4904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        200⤵
        
        PID:3804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        201⤵
        Modifies registry class
        
        PID:2492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        202⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        203⤵
        Modifies registry class
        
        PID:1588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        204⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        205⤵
        Modifies registry class
        
        PID:3472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        206⤵
        
        PID:624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        207⤵
        Modifies registry class
        
        PID:4112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        208⤵
        
        PID:2536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        209⤵
        
        PID:4732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        210⤵
        
        PID:1316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        211⤵
        Modifies registry class
        
        PID:3736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        212⤵
        
        PID:5076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        213⤵
        Modifies registry class
        
        PID:2540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        214⤵
        
        PID:2100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        215⤵
        
        PID:4988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        216⤵
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        217⤵
        Modifies registry class
        
        PID:4864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        218⤵
        
        PID:5072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        219⤵
        Modifies registry class
        
        PID:1460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        220⤵
        
        PID:4264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        221⤵
        
        PID:4452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        222⤵
        
        PID:4224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        223⤵
        Modifies registry class
        
        PID:3516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        224⤵
        
        PID:2892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        225⤵
        Modifies registry class
        
        PID:2008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        226⤵
        
        PID:1544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        227⤵
        
        PID:3460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        228⤵
        
        PID:1452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        229⤵
        Modifies registry class
        
        PID:2664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        230⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        231⤵
        Modifies registry class
        
        PID:4312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        232⤵
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        233⤵
        Modifies registry class
        
        PID:2392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        234⤵
        
        PID:4812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        235⤵
        
        PID:3952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        236⤵
        
        PID:1236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        237⤵
        
        PID:2224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        238⤵
        
        PID:5044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        239⤵
        
        PID:4140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        240⤵
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        241⤵
        Modifies registry class
        
        PID:3724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        242⤵
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        243⤵
        
        PID:3444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        244⤵
        
        PID:1796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        245⤵
        
        PID:2660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        246⤵
        
        PID:1124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        247⤵
        
        PID:3924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        248⤵
        
        PID:3508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        249⤵
        
        PID:1820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        250⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        251⤵
        
        PID:944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        252⤵
        
        PID:2832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        253⤵
        
        PID:3740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        254⤵
        
        PID:3536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        255⤵
        
        PID:1256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        256⤵
        
        PID:2552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        257⤵
        
        PID:808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        258⤵
        
        PID:3776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        259⤵
        
        PID:5060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        260⤵
        
        PID:3376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        261⤵
        
        PID:1724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        262⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        263⤵
        
        PID:5112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        264⤵
        
        PID:5016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        265⤵
        
        PID:2648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        266⤵
        
        PID:3104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        267⤵
        
        PID:3616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        268⤵
        
        PID:4820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        269⤵
        
        PID:1560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        270⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        271⤵
        
        PID:1860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        272⤵
        
        PID:4840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        273⤵
        
        PID:3300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        274⤵
        
        PID:4764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        275⤵
        
        PID:4816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        276⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        277⤵
        
        PID:3872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        278⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        279⤵
        
        PID:2700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        280⤵
        
        PID:4628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        281⤵
        
        PID:1432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        282⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        283⤵
        
        PID:3932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        284⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        285⤵
        
        PID:4340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        286⤵
        
        PID:4600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        287⤵
        
        PID:820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        288⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        289⤵
        
        PID:3704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        290⤵
        
        PID:3216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        291⤵
        
        PID:4496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        292⤵
        
        PID:1440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        293⤵
        
        PID:1240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        294⤵
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        295⤵
        
        PID:4068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        296⤵
        
        PID:1976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        297⤵
        
        PID:864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        298⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        299⤵
        
        PID:1500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        300⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        301⤵
        
        PID:5056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        302⤵
        
        PID:4208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        303⤵
        
        PID:2528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        304⤵
        
        PID:2124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        305⤵
        
        PID:724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        306⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        307⤵
        
        PID:3144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        308⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        309⤵
        
        PID:2904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        310⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        311⤵
        
        PID:4336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        312⤵
        
        PID:2044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        313⤵
        
        PID:2452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        314⤵
        
        PID:4588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        315⤵
        
        PID:176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        316⤵
        
        PID:1644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        317⤵
        
        PID:1032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        318⤵
        
        PID:2404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        319⤵
        
        PID:1940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        320⤵
        
        PID:3632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        321⤵
        
        PID:4156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        322⤵
        
        PID:3968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        323⤵
        
        PID:4212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        324⤵
        
        PID:392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        325⤵
        
        PID:652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        326⤵
        
        PID:3780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        327⤵
        
        PID:1868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        328⤵
        
        PID:4868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        329⤵
        
        PID:3928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        330⤵
        
        PID:3520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        331⤵
        
        PID:4220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        332⤵
        
        PID:884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        333⤵
        
        PID:216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        334⤵
        
        PID:2604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        335⤵
        
        PID:4800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        336⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        337⤵
        
        PID:4716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        338⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        339⤵
        
        PID:772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        340⤵
        
        PID:4024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        341⤵
        
        PID:548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        342⤵
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        343⤵
        
        PID:4636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        344⤵
        
        PID:4524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        345⤵
        
        PID:1476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        346⤵
        
        PID:1832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        347⤵
        
        PID:3416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        348⤵
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        349⤵
        
        PID:3496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        350⤵
        
        PID:3312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        351⤵
        
        PID:760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        352⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        353⤵
        
        PID:412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        354⤵
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        355⤵
        
        PID:3648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        356⤵
        
        PID:1792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        357⤵
        
        PID:2140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        358⤵
        
        PID:4500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        359⤵
        
        PID:1744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        360⤵
        
        PID:5200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        361⤵
        
        PID:5316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        362⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        363⤵
        
        PID:5548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        364⤵
        
        PID:5640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        365⤵
        
        PID:5756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        366⤵
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        367⤵
        
        PID:5944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        368⤵
        
        PID:6040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        369⤵
        
        PID:4760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        370⤵
        
        PID:2732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        371⤵
        
        PID:5244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        372⤵
        
        PID:5140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        373⤵
        
        PID:5428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        374⤵
        
        PID:5544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        375⤵
        
        PID:5784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        376⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        377⤵
        
        PID:5840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        378⤵
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        379⤵
        
        PID:6124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        380⤵
        
        PID:3220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        381⤵
        
        PID:4784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        382⤵
        
        PID:2240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        383⤵
        
        PID:5532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        384⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        385⤵
        
        PID:5372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        386⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        387⤵
        
        PID:5932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        388⤵
        
        PID:6120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        389⤵
        
        PID:6068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        390⤵
        
        PID:2188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        391⤵
        
        PID:6072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        392⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        393⤵
        
        PID:5188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        394⤵
        
        PID:5376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        395⤵
        
        PID:212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        396⤵
        
        PID:5620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        397⤵
        
        PID:5488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        398⤵
        
        PID:5820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        399⤵
        
        PID:5660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        400⤵
        
        PID:5964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        401⤵
        
        PID:5980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        402⤵
        
        PID:5152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        403⤵
        
        PID:5380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        404⤵
        
        PID:5400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        405⤵
        
        PID:5304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        406⤵
        
        PID:5860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        407⤵
        
        PID:3096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        408⤵
        
        PID:6052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        409⤵
        
        PID:3020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        410⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        411⤵
        
        PID:6136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        412⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        413⤵
        
        PID:5168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        414⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        415⤵
        
        PID:5604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        416⤵
        
        PID:5852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        417⤵
        
        PID:5720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        418⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        419⤵
        
        PID:5748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        420⤵
        
        PID:1120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        421⤵
        
        PID:5268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        422⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        423⤵
        
        PID:6080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        424⤵
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        425⤵
        
        PID:6076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        426⤵
        
        PID:5888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        427⤵
        
        PID:5740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        428⤵
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        429⤵
        
        PID:5680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        430⤵
        
        PID:5876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        431⤵
        
        PID:4856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        432⤵
        
        PID:5216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        433⤵
        
        PID:5144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        434⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        435⤵
        
        PID:5444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        436⤵
        
        PID:5448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        437⤵
        
        PID:6088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        438⤵
        
        PID:5988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        439⤵
        
        PID:3116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        440⤵
        
        PID:5676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        441⤵
        
        PID:988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        442⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        443⤵
        
        PID:5616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        444⤵
        
        PID:5936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        445⤵
        
        PID:5792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        446⤵
        
        PID:5924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        447⤵
        
        PID:1748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        448⤵
        
        PID:5956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        449⤵
        
        PID:5768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        450⤵
        
        PID:5516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        451⤵
        
        PID:5880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        452⤵
        
        PID:5884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        453⤵
        
        PID:5332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        454⤵
        
        PID:5976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        455⤵
        
        PID:2104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        456⤵
        
        PID:6008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        457⤵
        
        PID:5816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        458⤵
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        459⤵
        
        PID:5184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        460⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        461⤵
        
        PID:5456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        462⤵
        
        PID:5484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        463⤵
        
        PID:5772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        464⤵
        
        PID:5404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        465⤵
        
        PID:5388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        466⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        467⤵
        
        PID:5656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        468⤵
        
        PID:3856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        469⤵
        
        PID:3000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        470⤵
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        471⤵
        
        PID:5948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        472⤵
        
        PID:5160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        473⤵
        
        PID:5136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        474⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        475⤵
        
        PID:5348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        476⤵
        
        PID:3620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        477⤵
        
        PID:5592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        478⤵
        
        PID:1220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        479⤵
        
        PID:5552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        480⤵
        
        PID:5460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        481⤵
        
        PID:6140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        482⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        483⤵
        
        PID:5492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        484⤵
        
        PID:5712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        485⤵
        
        PID:5780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        486⤵
        
        PID:5776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        487⤵
        
        PID:6108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        488⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        489⤵
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        490⤵
        
        PID:3112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        491⤵
        
        PID:5224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        492⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        493⤵
        
        PID:5708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        494⤵
        
        PID:5276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        495⤵
        
        PID:5628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        496⤵
        
        PID:3708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        497⤵
        
        PID:6024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        498⤵
        
        PID:5208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        499⤵
        
        PID:5724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        500⤵
        
        PID:5912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        501⤵
        
        PID:1800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        502⤵
        
        PID:5600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        503⤵
        
        PID:5264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        504⤵
        
        PID:5436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        505⤵
        
        PID:5992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        506⤵
        
        PID:6044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        507⤵
        
        PID:536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        508⤵
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        509⤵
        
        PID:5856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        510⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        511⤵
        
        PID:5624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        512⤵
        
        PID:5176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        513⤵
        
        PID:5568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        514⤵
        
        PID:5528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        515⤵
        
        PID:5940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        516⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        517⤵
        
        PID:5464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        518⤵
        
        PID:5452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        519⤵
        
        PID:5232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        520⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        521⤵
        
        PID:628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        522⤵
        
        PID:6056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        523⤵
        
        PID:464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        524⤵
        
        PID:5520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        525⤵
        
        PID:5284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        526⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        527⤵
        
        PID:5328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        528⤵
        
        PID:5916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        529⤵
        
        PID:5836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        530⤵
        
        PID:5696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        531⤵
        
        PID:932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        532⤵
        
        PID:5664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        533⤵
        
        PID:5728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        534⤵
        
        PID:1900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        535⤵
        
        PID:5392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        536⤵
        
        PID:6132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        537⤵
        
        PID:1172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        538⤵
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        539⤵
        
        PID:1780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        540⤵
        
        PID:5984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...