b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a

Analysis

max time kernel
41s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/03/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat
Size 251B
Sample260331-mz9snact7x
SHA256 b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a
MD5 fe27e510850f077e970a158a1a7b4103
SHA1 d4346b246e56f3d15e24fe30b91f989ac243e252
SHA512 753d95960213d013c51b9c4f983c18e74a30a6fd413787781d2a5dede65f11717d6b5984dc42244cb04be33b834893bb82ebf6ce5cbd61ffd10fb79755cbff2c
TLSH
T1FCD0974B11240066CAB4CAA412AE7302AE4B312710032D9A322F543A7F180B3C2DA098
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
732	powershell.exe
5896	powershell.exe
5168	powershell.exe
2584	powershell.exe
1640	powershell.exe
1932	powershell.exe
6084	powershell.exe
2692	powershell.exe
2608	powershell.exe
4516	powershell.exe
6052	powershell.exe
5188	powershell.exe
3872	powershell.exe
5184	powershell.exe
6072	powershell.exe
4876	powershell.exe
2948	powershell.exe
4952	powershell.exe
1336	powershell.exe
4356	powershell.exe
3676	powershell.exe
1008	powershell.exe
1716	powershell.exe
5616	powershell.exe
4404	powershell.exe
2076	powershell.exe
3568	powershell.exe
5892	powershell.exe
5428	powershell.exe
4884	powershell.exe
4456	powershell.exe
2532	powershell.exe
784	powershell.exe
464	powershell.exe
3700	powershell.exe
2728	powershell.exe
1368	powershell.exe
468	powershell.exe
2140	powershell.exe
5336	powershell.exe
5388	powershell.exe
968	powershell.exe
2128	powershell.exe
2912	powershell.exe
4668	powershell.exe
3716	powershell.exe
572	powershell.exe
1156	powershell.exe
1000	powershell.exe
660	powershell.exe
5684	powershell.exe
4196	powershell.exe
2468	powershell.exe
4280	powershell.exe
1036	powershell.exe
3540	powershell.exe
5232	powershell.exe
220	powershell.exe
3328	powershell.exe
2960	powershell.exe
4468	powershell.exe
4312	powershell.exe
5776	powershell.exe
5920	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2044	powershell.exe
2044	powershell.exe
1100	powershell.exe
1100	powershell.exe
3188	powershell.exe
3188	powershell.exe
4456	powershell.exe
4456	powershell.exe
2584	powershell.exe
2584	powershell.exe
2808	powershell.exe
2808	powershell.exe
2532	powershell.exe
2532	powershell.exe
1388	powershell.exe
1388	powershell.exe
4964	powershell.exe
4964	powershell.exe
4304	powershell.exe
4304	powershell.exe
4668	powershell.exe
4668	powershell.exe
3120	powershell.exe
3120	powershell.exe
2948	powershell.exe
2948	powershell.exe
3872	powershell.exe
3872	powershell.exe
2444	powershell.exe
2444	powershell.exe
1600	powershell.exe
1600	powershell.exe
1156	powershell.exe
1156	powershell.exe
3156	powershell.exe
3156	powershell.exe
3216	powershell.exe
3216	powershell.exe
760	powershell.exe
760	powershell.exe
1140	powershell.exe
1140	powershell.exe
2552	powershell.exe
2552	powershell.exe
932	powershell.exe
932	powershell.exe
4684	powershell.exe
4684	powershell.exe
5012	powershell.exe
5012	powershell.exe
1028	powershell.exe
1028	powershell.exe
4452	powershell.exe
4452	powershell.exe
996	powershell.exe
996	powershell.exe
4264	powershell.exe
4264	powershell.exe
1624	powershell.exe
1624	powershell.exe
1636	powershell.exe
1636	powershell.exe
1572	powershell.exe
1572	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2044	2504	cmd.exe	80
PID 2044 wrote to memory of 3400	2044	powershell.exe	82
PID 3400 wrote to memory of 1100	3400	cmd.exe	84
PID 1100 wrote to memory of 3420	1100	powershell.exe	85
PID 3420 wrote to memory of 3188	3420	cmd.exe	87
PID 3188 wrote to memory of 1296	3188	powershell.exe	88
PID 1296 wrote to memory of 4456	1296	cmd.exe	90
PID 4456 wrote to memory of 2456	4456	powershell.exe	91
PID 2456 wrote to memory of 2584	2456	cmd.exe	93
PID 2584 wrote to memory of 2064	2584	powershell.exe	94
PID 2064 wrote to memory of 2808	2064	cmd.exe	96
PID 2808 wrote to memory of 3396	2808	powershell.exe	97
PID 3396 wrote to memory of 2532	3396	cmd.exe	99
PID 2532 wrote to memory of 3128	2532	powershell.exe	101
PID 3128 wrote to memory of 1388	3128	cmd.exe	103
PID 1388 wrote to memory of 1760	1388	powershell.exe	104
PID 1760 wrote to memory of 4964	1760	cmd.exe	106
PID 4964 wrote to memory of 928	4964	powershell.exe	107
PID 928 wrote to memory of 4304	928	cmd.exe	109
PID 4304 wrote to memory of 4652	4304	powershell.exe	110
PID 4652 wrote to memory of 4668	4652	cmd.exe	112
PID 4668 wrote to memory of 3936	4668	powershell.exe	113
PID 3936 wrote to memory of 3120	3936	cmd.exe	115
PID 3120 wrote to memory of 3152	3120	powershell.exe	116
PID 3152 wrote to memory of 2948	3152	cmd.exe	118
PID 2948 wrote to memory of 3848	2948	powershell.exe	119
PID 3848 wrote to memory of 3872	3848	cmd.exe	121
PID 3872 wrote to memory of 2420	3872	powershell.exe	122
PID 2420 wrote to memory of 2444	2420	cmd.exe	124
PID 2444 wrote to memory of 5080	2444	powershell.exe	125
PID 5080 wrote to memory of 1600	5080	cmd.exe	127
PID 1600 wrote to memory of 4988	1600	powershell.exe	128
PID 4988 wrote to memory of 1156	4988	cmd.exe	130
PID 1156 wrote to memory of 1500	1156	powershell.exe	131
PID 1500 wrote to memory of 3156	1500	cmd.exe	134
PID 3156 wrote to memory of 2088	3156	powershell.exe	135
PID 2088 wrote to memory of 3216	2088	cmd.exe	137
PID 3216 wrote to memory of 3900	3216	powershell.exe	138
PID 3900 wrote to memory of 760	3900	cmd.exe	140
PID 760 wrote to memory of 4028	760	powershell.exe	141
PID 4028 wrote to memory of 1140	4028	cmd.exe	143
PID 1140 wrote to memory of 5100	1140	powershell.exe	144
PID 5100 wrote to memory of 2552	5100	cmd.exe	146
PID 2552 wrote to memory of 1644	2552	powershell.exe	147
PID 1644 wrote to memory of 932	1644	cmd.exe	149
PID 932 wrote to memory of 4192	932	powershell.exe	150
PID 4192 wrote to memory of 4684	4192	cmd.exe	152
PID 4684 wrote to memory of 4128	4684	powershell.exe	153
PID 4128 wrote to memory of 5012	4128	cmd.exe	155
PID 5012 wrote to memory of 1796	5012	powershell.exe	156
PID 1796 wrote to memory of 1028	1796	cmd.exe	158
PID 1028 wrote to memory of 4864	1028	powershell.exe	159
PID 4864 wrote to memory of 4452	4864	cmd.exe	161
PID 4452 wrote to memory of 864	4452	powershell.exe	162
PID 864 wrote to memory of 996	864	cmd.exe	164
PID 996 wrote to memory of 328	996	powershell.exe	165
PID 328 wrote to memory of 4264	328	cmd.exe	167
PID 4264 wrote to memory of 3972	4264	powershell.exe	168
PID 3972 wrote to memory of 1624	3972	cmd.exe	170
PID 1624 wrote to memory of 5108	1624	powershell.exe	171
PID 5108 wrote to memory of 1636	5108	cmd.exe	173
PID 1636 wrote to memory of 2056	1636	powershell.exe	174
PID 2056 wrote to memory of 1572	2056	cmd.exe	176
PID 1572 wrote to memory of 3640	1572	powershell.exe	177

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3420
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        7⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        9⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        11⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        12⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        13⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        16⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        17⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        18⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        19⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        20⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        22⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        24⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        25⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        26⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        27⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        28⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        29⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        30⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        32⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        33⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        34⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        35⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        36⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        37⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        38⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        39⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        40⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        41⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        42⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        43⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        44⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        45⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        46⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        47⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        48⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        49⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        50⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        51⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        52⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        53⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        54⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        55⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        56⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        57⤵
        Suspicious use of WriteProcessMemory
        
        PID:328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        58⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        59⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        60⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        61⤵
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        62⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        63⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        64⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        65⤵
        Modifies registry class
        
        PID:3640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        66⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        67⤵
        Modifies registry class
        
        PID:2176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        68⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        69⤵
        Modifies registry class
        
        PID:892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        70⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        71⤵
        Modifies registry class
        
        PID:2104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        72⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        73⤵
        Modifies registry class
        
        PID:3528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        74⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        75⤵
        Modifies registry class
        
        PID:4012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        76⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        77⤵
        
        PID:3952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        78⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        79⤵
        Modifies registry class
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        80⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        81⤵
        Modifies registry class
        
        PID:2132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        82⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        83⤵
        Modifies registry class
        
        PID:424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        84⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        85⤵
        Modifies registry class
        
        PID:2320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        86⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        87⤵
        Modifies registry class
        
        PID:1112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        88⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        89⤵
        Modifies registry class
        
        PID:1392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        90⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        91⤵
        Modifies registry class
        
        PID:1148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        92⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        93⤵
        
        PID:4272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        94⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        95⤵
        Modifies registry class
        
        PID:3876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        96⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        97⤵
        Modifies registry class
        
        PID:4888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        98⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        99⤵
        Modifies registry class
        
        PID:4576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        100⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        101⤵
        Modifies registry class
        
        PID:244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        102⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        103⤵
        Modifies registry class
        
        PID:2512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        104⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        105⤵
        Modifies registry class
        
        PID:1512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        106⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        107⤵
        Modifies registry class
        
        PID:1204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        108⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        109⤵
        Modifies registry class
        
        PID:3324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        110⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        111⤵
        
        PID:3576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        112⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        113⤵
        Modifies registry class
        
        PID:2404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        114⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        115⤵
        Modifies registry class
        
        PID:3416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        116⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        117⤵
        Modifies registry class
        
        PID:1060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        118⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        119⤵
        Modifies registry class
        
        PID:4400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        120⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        121⤵
        Modifies registry class
        
        PID:1652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        122⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        123⤵
        Modifies registry class
        
        PID:2080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        124⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        125⤵
        Modifies registry class
        
        PID:4444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        126⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        127⤵
        Modifies registry class
        
        PID:2040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        128⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        129⤵
        Modifies registry class
        
        PID:4728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        130⤵
        
        PID:5052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        131⤵
        Modifies registry class
        
        PID:3272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        132⤵
        
        PID:1688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        133⤵
        Modifies registry class
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        134⤵
        
        PID:3764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        135⤵
        Modifies registry class
        
        PID:4428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        136⤵
        
        PID:1916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        137⤵
        Modifies registry class
        
        PID:5028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        138⤵
        
        PID:1016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        139⤵
        Modifies registry class
        
        PID:2544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        140⤵
        
        PID:2220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        141⤵
        Modifies registry class
        
        PID:1196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        142⤵
        
        PID:4616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        143⤵
        Modifies registry class
        
        PID:4004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        144⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        145⤵
        
        PID:2244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        146⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        147⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        148⤵
        
        PID:3228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        149⤵
        Modifies registry class
        
        PID:352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        150⤵
        
        PID:2560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        151⤵
        Modifies registry class
        
        PID:2168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        152⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        153⤵
        
        PID:1396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        154⤵
        
        PID:2248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        155⤵
        
        PID:2352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        156⤵
        
        PID:1472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        157⤵
        
        PID:2368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        158⤵
        
        PID:3244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        159⤵
        
        PID:3544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        160⤵
        
        PID:2356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        161⤵
        
        PID:4588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        162⤵
        
        PID:4020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        163⤵
        
        PID:1936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        164⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        165⤵
        
        PID:2904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        166⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        167⤵
        
        PID:1536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        168⤵
        
        PID:4120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        169⤵
        
        PID:2108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        170⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        171⤵
        
        PID:3236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        172⤵
        
        PID:1432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        173⤵
        
        PID:2832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        174⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        175⤵
        
        PID:3312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        176⤵
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        177⤵
        
        PID:3392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        178⤵
        
        PID:4212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        179⤵
        
        PID:2524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        180⤵
        
        PID:1428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        181⤵
        
        PID:3948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        182⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        183⤵
        
        PID:3004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        184⤵
        
        PID:2300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        185⤵
        
        PID:2620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        186⤵
        
        PID:3444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        187⤵
        
        PID:3536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        188⤵
        
        PID:3852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        189⤵
        
        PID:1668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        190⤵
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        191⤵
        
        PID:1308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        192⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        193⤵
        
        PID:2136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        194⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        195⤵
        
        PID:536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        196⤵
        
        PID:3904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        197⤵
        
        PID:4784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        198⤵
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        199⤵
        
        PID:4320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        200⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        201⤵
        
        PID:428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        202⤵
        
        PID:1532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        203⤵
        
        PID:4556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        204⤵
        
        PID:2980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        205⤵
        
        PID:1104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        206⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        207⤵
        
        PID:124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        208⤵
        
        PID:2200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        209⤵
        
        PID:4188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        210⤵
        
        PID:3040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        211⤵
        
        PID:2488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        212⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        213⤵
        
        PID:4992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        214⤵
        
        PID:1416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        215⤵
        
        PID:4960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        216⤵
        
        PID:3092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        217⤵
        
        PID:2424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        218⤵
        
        PID:4228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        219⤵
        
        PID:2932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        220⤵
        
        PID:4324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        221⤵
        
        PID:2588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        222⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        223⤵
        
        PID:3424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        224⤵
        
        PID:644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        225⤵
        
        PID:4540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        226⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        227⤵
        
        PID:4700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        228⤵
        
        PID:5092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        229⤵
        
        PID:2028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        230⤵
        
        PID:4804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        231⤵
        
        PID:4944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        232⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        233⤵
        
        PID:4492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        234⤵
        
        PID:3824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        235⤵
        
        PID:236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        236⤵
        
        PID:3276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        237⤵
        
        PID:3792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        238⤵
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        239⤵
        
        PID:912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        240⤵
        
        PID:2408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        241⤵
        
        PID:3928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        242⤵
        
        PID:1252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        243⤵
        
        PID:3456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        244⤵
        
        PID:656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        245⤵
        
        PID:4472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        246⤵
        
        PID:1176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        247⤵
        
        PID:2984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        248⤵
        
        PID:2360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        249⤵
        
        PID:3196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        250⤵
        
        PID:2520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        251⤵
        
        PID:3588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        252⤵
        
        PID:2916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        253⤵
        
        PID:2012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        254⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        255⤵
        
        PID:1800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        256⤵
        
        PID:3796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        257⤵
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        258⤵
        
        PID:3284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        259⤵
        
        PID:4768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        260⤵
        
        PID:4176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        261⤵
        
        PID:3404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        262⤵
        
        PID:3564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        263⤵
        
        PID:4316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        264⤵
        
        PID:5072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        265⤵
        
        PID:4896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        266⤵
        
        PID:404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        267⤵
        
        PID:2464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        268⤵
        
        PID:1484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        269⤵
        
        PID:1632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        270⤵
        
        PID:4136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        271⤵
        
        PID:2764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        272⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        273⤵
        
        PID:2416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        274⤵
        
        PID:1928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        275⤵
        
        PID:3176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        276⤵
        
        PID:5104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        277⤵
        
        PID:4436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        278⤵
        
        PID:4940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        279⤵
        
        PID:2756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        280⤵
        
        PID:3088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        281⤵
        
        PID:2624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        282⤵
        
        PID:2212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        283⤵
        
        PID:4084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        284⤵
        
        PID:1124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        285⤵
        
        PID:2036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        286⤵
        
        PID:3836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        287⤵
        
        PID:3868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        288⤵
        
        PID:832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        289⤵
        
        PID:4384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        290⤵
        
        PID:788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        291⤵
        
        PID:1448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        292⤵
        
        PID:3184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        293⤵
        
        PID:3368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        294⤵
        
        PID:3380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        295⤵
        
        PID:2460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        296⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        297⤵
        
        PID:3996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        298⤵
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        299⤵
        
        PID:2276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        300⤵
        
        PID:2772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        301⤵
        
        PID:2304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        302⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        303⤵
        
        PID:3164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        304⤵
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        305⤵
        
        PID:4936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        306⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        307⤵
        
        PID:2480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        308⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        309⤵
        
        PID:1968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        310⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        311⤵
        
        PID:1752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        312⤵
        
        PID:4036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        313⤵
        
        PID:4840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        314⤵
        
        PID:400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        315⤵
        
        PID:2380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        316⤵
        
        PID:4408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        317⤵
        
        PID:1292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        318⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        319⤵
        
        PID:3656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        320⤵
        
        PID:4440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        321⤵
        
        PID:4844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        322⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        323⤵
        
        PID:1720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        324⤵
        
        PID:2568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        325⤵
        
        PID:3264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        326⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        327⤵
        
        PID:1032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        328⤵
        
        PID:4716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        329⤵
        
        PID:4532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        330⤵
        
        PID:3844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        331⤵
        
        PID:4132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        332⤵
        
        PID:2372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        333⤵
        
        PID:3908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        334⤵
        
        PID:3728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        335⤵
        
        PID:2612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        336⤵
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        337⤵
        
        PID:3180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        338⤵
        
        PID:2492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        339⤵
        
        PID:3360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        340⤵
        
        PID:2920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        341⤵
        
        PID:1020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        342⤵
        
        PID:4908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        343⤵
        
        PID:2364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        344⤵
        
        PID:3056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        345⤵
        
        PID:4248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        346⤵
        
        PID:568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        347⤵
        
        PID:3916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        348⤵
        
        PID:2540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        349⤵
        
        PID:1856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        350⤵
        
        PID:1144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        351⤵
        
        PID:1588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        352⤵
        
        PID:4920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        353⤵
        
        PID:4172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        354⤵
        
        PID:2680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        355⤵
        
        PID:4812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        356⤵
        
        PID:4364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        357⤵
        
        PID:240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        358⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        359⤵
        
        PID:420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        360⤵
        
        PID:1200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        361⤵
        
        PID:4076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        362⤵
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        363⤵
        
        PID:1424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        364⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        365⤵
        
        PID:3220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        366⤵
        
        PID:4792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        367⤵
        
        PID:2508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        368⤵
        
        PID:4000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        369⤵
        
        PID:232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        370⤵
        
        PID:2636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        371⤵
        
        PID:4924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        372⤵
        
        PID:5156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        373⤵
        
        PID:5264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        374⤵
        
        PID:5340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        375⤵
        
        PID:5448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        376⤵
        
        PID:5528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        377⤵
        
        PID:5636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        378⤵
        
        PID:5712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        379⤵
        
        PID:5816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        380⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        381⤵
        
        PID:6008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        382⤵
        
        PID:6120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        383⤵
        
        PID:5216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        384⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        385⤵
        
        PID:5344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        386⤵
        
        PID:5268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        387⤵
        
        PID:5564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        388⤵
        
        PID:5464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        389⤵
        
        PID:5744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        390⤵
        
        PID:5956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        391⤵
        
        PID:5884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        392⤵
        
        PID:6116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        393⤵
        
        PID:2952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        394⤵
        
        PID:5400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        395⤵
        
        PID:5240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        396⤵
        
        PID:5540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        397⤵
        
        PID:5432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        398⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        399⤵
        
        PID:5980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        400⤵
        
        PID:6044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        401⤵
        
        PID:5020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        402⤵
        
        PID:4416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        403⤵
        
        PID:3136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        404⤵
        
        PID:5220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        405⤵
        
        PID:6016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        406⤵
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        407⤵
        
        PID:5480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        408⤵
        
        PID:5700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        409⤵
        
        PID:5984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        410⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        411⤵
        
        PID:5992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        412⤵
        
        PID:972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        413⤵
        
        PID:552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        414⤵
        
        PID:6108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        415⤵
        
        PID:5484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        416⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        417⤵
        
        PID:5752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        418⤵
        
        PID:5376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        419⤵
        
        PID:5900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        420⤵
        
        PID:4072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        421⤵
        
        PID:1524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        422⤵
        
        PID:5380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        423⤵
        
        PID:6012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        424⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        425⤵
        
        PID:5996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        426⤵
        
        PID:5772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        427⤵
        
        PID:5940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        428⤵
        
        PID:5864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        429⤵
        
        PID:6048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        430⤵
        
        PID:5208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        431⤵
        
        PID:5832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        432⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        433⤵
        
        PID:6032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        434⤵
        
        PID:2968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        435⤵
        
        PID:5228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        436⤵
        
        PID:4644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        437⤵
        
        PID:4484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        438⤵
        
        PID:1248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        439⤵
        
        PID:1160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        440⤵
        
        PID:5500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        441⤵
        
        PID:5640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        442⤵
        
        PID:6088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        443⤵
        
        PID:5696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        444⤵
        
        PID:5976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        445⤵
        
        PID:5556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        446⤵
        
        PID:3896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        447⤵
        
        PID:3660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        448⤵
        
        PID:5396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        449⤵
        
        PID:768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        450⤵
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        451⤵
        
        PID:6064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        452⤵
        
        PID:6068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        453⤵
        
        PID:5456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        454⤵
        
        PID:5880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        455⤵
        
        PID:5868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        456⤵
        
        PID:5608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        457⤵
        
        PID:5416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        458⤵
        
        PID:5284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        459⤵
        
        PID:5192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        460⤵
        
        PID:2640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        461⤵
        
        PID:2672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        462⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        463⤵
        
        PID:5164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        464⤵
        
        PID:5364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        465⤵
        
        PID:6124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        466⤵
        
        PID:5420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        467⤵
        
        PID:5152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        468⤵
        
        PID:5492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        469⤵
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        470⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        471⤵
        
        PID:5360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        472⤵
        
        PID:5576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        473⤵
        
        PID:4520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        474⤵
        
        PID:5724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        475⤵
        
        PID:5664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        476⤵
        
        PID:5756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        477⤵
        
        PID:5904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        478⤵
        
        PID:5624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        479⤵
        
        PID:4772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        480⤵
        
        PID:5516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        481⤵
        
        PID:5876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        482⤵
        
        PID:5280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        483⤵
        
        PID:3748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        484⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        485⤵
        
        PID:5592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        486⤵
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        487⤵
        
        PID:6128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        488⤵
        
        PID:5412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        489⤵
        
        PID:5308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        490⤵
        
        PID:3512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        491⤵
        
        PID:5812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        492⤵
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        493⤵
        
        PID:6100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        494⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        495⤵
        
        PID:5160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        496⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        497⤵
        
        PID:5672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        498⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        499⤵
        
        PID:5224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        500⤵
        
        PID:4500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        501⤵
        
        PID:6004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        502⤵
        
        PID:5688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        503⤵
        
        PID:5520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        504⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        505⤵
        
        PID:196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        506⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        507⤵
        
        PID:2868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        508⤵
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        509⤵
        
        PID:5660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        510⤵
        
        PID:5852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        511⤵
        
        PID:4912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        512⤵
        
        PID:5588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        513⤵
        
        PID:5964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        514⤵
        
        PID:3412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        515⤵
        
        PID:5840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        516⤵
        
        PID:5136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        517⤵
        
        PID:5916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        518⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        519⤵
        
        PID:5720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        520⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        521⤵
        
        PID:5784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        522⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        523⤵
        
        PID:2308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        524⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        525⤵
        
        PID:1972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        526⤵
        
        PID:6040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        527⤵
        
        PID:5488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        528⤵
        
        PID:412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        529⤵
        
        PID:5124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        530⤵
        
        PID:3828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat" h "
        531⤵
        
        PID:5424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat' -ArgumentList 'h' -WindowStyle Hidden"
        532⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...