f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5

General

Target
f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5.exe
Size 113KB
Sample260720-rvtyvsfs4w
SHA256 f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5
MD5 3baeef2949013f19b93465d34064be0a
SHA1 374d8c7ddf17f06aac458f431a486c05608fa07e
SHA512 a98be1ad9cfd7b93a700e6b250b86ce493b68ffce92e3c319f73598f21730d12632ec692c30fdd27983e470257a2eef6a1f4cbcaba9267e1b36c007b83a3fefc
SSDEEP 1536:r0kwU8LawT+nOFI2vbVq5khfpIdM30sgQCfZo+U4YTuG9VNRsd:7ozT+OF7vpLhfuWBrCBV8rVsd
TLSH
T1C2B33A27FA56107DE161C6BACED78D52EF317C8A07916BEF07804CE24E562C0AF39612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x001000000001b664-2.dat	disable_win_def

Executes dropped EXE 2 IoCs

pid	Process
4188	svchost.exe
2480	WindowsUpdateService.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	WindowsUpdateService.exe

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x001000000001b664-2.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4188	3032	f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5.exe	89
PID 3032 wrote to memory of 2480	3032	f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5.exe	91

C:\Users\Admin\AppData\Local\Temp\f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5.exe
"C:\Users\Admin\AppData\Local\Temp\f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4188
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
    3⤵
    PID:5456
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:27312
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:30140
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:19376
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:18316
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:22076
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:23932
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:40532
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:21884
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:35184
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:23168
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:40144
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:27052
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:20908
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:24472
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:38576
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27008
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:25908
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27940
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:25756
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27932
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:18552
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:20552
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:34140
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:29480
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:32336
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:20728
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:33376
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:36040
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:23064
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:26176
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:24040
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:29524
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:26516
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26536
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:28680
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:18056
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:29888
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:33196
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:20712
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:33360
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:36956
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:21752
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:35720
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:40380
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:25080
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:38792
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27916
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:3160
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:21100
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:31692
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:35516
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:23152
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:36404
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:25748
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:24392
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:38720
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27548
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:27320
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30116
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:19268
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:33564
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:20772
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:33324
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:37656
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:24432
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:37616
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:26832
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:28840
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:31580
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20000
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:21800
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:35508
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:22872
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:35712
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:40556
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:24904
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:39608
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30148
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:18116
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:29440
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:31752
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20644
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:33232
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:36940
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:23376
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23952
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:37052
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:3384
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
    3⤵
    PID:1956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:832
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:30892
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:24660
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:23132
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:22272
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:25652
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:29192
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26468
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:28764
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:18568
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:29748
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:33116
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26636
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30208
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20016
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:35500
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:35532
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36784
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:20140
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26680
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30164
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:18732
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:31248
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:25608
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20748
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:34440
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:37808
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19176
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:31240
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:21616
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:38240
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:38540
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:26956
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27884
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:18104
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:29244
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:22364
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19012
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:30368
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:33468
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:33496
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:28416
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:21364
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:34532
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:37696
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23352
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36836
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:27280
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:30124
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:18332
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:29800
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:32844
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20704
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:34240
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:37816
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:24316
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27460
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26264
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:38504
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:25900
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27924
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
    3⤵
    PID:6092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:2956
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:29516
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:20736
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:33384
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:37664
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:21108
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:34636
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:38248
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:23876
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:36920
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26140
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:28692
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:17832
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:32344
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:23976
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:26272
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:26280
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:27392
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30132
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:21444
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:52
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:18656
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23868
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:37092
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:28876
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:21192
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20336
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:31232
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:22552
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:21900
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:25248
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:18560
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:24912
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:35760
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19024
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:31224
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:23044
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20764
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:33416
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:37648
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:22492
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:35660
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:33724
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23524
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:39308
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:21340
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:34356
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        10⤵
        
        PID:38012
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:23892
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:37040
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:28884
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:31588
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:25424
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:39528
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27860
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:28556
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30760
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19624
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:30420
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:21940
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:24268
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:39436
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:26796
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:23768
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:38584
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27540
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30156
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:27212
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:30100
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:19940
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:22112
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:36024
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19260
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:20620
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:26488
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:21624
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:34780
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:22716
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27468
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
    3⤵
    PID:5680
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:1560
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:25556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        10⤵
        
        PID:38564
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:27876
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:27380
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:20100
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:35524
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23020
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36712
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26384
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:28724
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:18080
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:17596
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:21612
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:17452
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:28504
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:31512
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20008
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:32616
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:35548
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19136
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:30984
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20780
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:33300
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:36704
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:22368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:35796
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:40572
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:26004
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:21356
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:34896
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:23312
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23904
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:37128
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:27436
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:4624
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:26116
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:28024
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:18492
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:31292
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:34368
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:21452
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:31828
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:23920
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:37160
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:28588
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:19948
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:32432
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:35540
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:20124
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:32236
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:36032
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36572
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:40168
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:35672
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:40452
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:24812
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:40080
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:31504
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27900
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:28868

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
PID:2912
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
  2⤵
  PID:2508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
    3⤵
    PID:3436
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:3740
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19616
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:18864
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:32128
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:20788
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:30800
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:33464
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:23080
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:35788
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:38180
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:24584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:29136
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:21756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:34708
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:37728
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:25060
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:38952
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:27288
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:40348
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:29016
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:22992
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:38340
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36900
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:20244
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36720
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:31464
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:26524
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:40444
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:17876
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:23244
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27908
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:20308
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:30332
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:24100
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:22104
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:38048
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:24632
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:29588
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:23724
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36060
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:39032
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:25824
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:27956
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:27332
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:28968
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:19416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:29836
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26232
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:40128
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27772
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:19436
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:20452
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19164
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:21840
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:25464
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:38100
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
    3⤵
    PID:3312
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:2340
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26108
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27764
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:18640
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:28084
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:17512
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26168
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:39732
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:28808
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:19428
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:29264
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:31520
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:17568
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26044
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:31600
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:26628
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:19532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:32312
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:20904
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:34232
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:37688
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:23200
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26016
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:38512
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:6732
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:20300
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:30172
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:24572
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:34148
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:37720
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:21580
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:34540
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:38000
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:36636
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:38368
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:21436
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:33204
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:36488
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:23448
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:36048
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:21712
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:40136
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:26548
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:40120
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
  2⤵
  PID:3244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
    3⤵
    PID:5552
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:3448
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19932
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:30324
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:22728
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:21632
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:34564
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:37712
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26128
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:22584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:38064
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:24624
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:29940
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:35708
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:23944
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:36412
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        9⤵
        
        PID:40216
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:26032
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:39024
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:23592
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:38444
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:26508
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:40544
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:18724
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:27716
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:19792
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:16776
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        9⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:27892
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:19760
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:18764
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:31920
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26072
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:20036
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:29700
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:22484
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:20028
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:32320
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:21876
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:33896
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:37680
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:19924
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:19004
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:32328
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:21636
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:33924
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:37704
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:23488
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:35228
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:21120
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:25612
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:38392
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
    3⤵
    PID:3012
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:27144
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:30108
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:20044
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:30708
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:33048
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:22044
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:33444
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:36792
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:23884
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:37460
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:18804
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:29068
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:31784
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:20720
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:30916
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:33840
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:22864
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:34552
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:37672
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:24760
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:38484
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        5⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:20952
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:32392
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:28216
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:22532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:34604
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:37960
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:23912
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:36668
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:25668
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:38436
    - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        5⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        6⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        8⤵
        
        PID:26428
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        8⤵
        
        PID:40176
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:26788
      - C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        6⤵
        
        PID:18648
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
        7⤵
        
        PID:28092
        
        C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        7⤵
        
        PID:8156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 731fce6086ee9c81a2a44954a0d500c0ca13c9dab5d07e42e0fb20658abc11fa
MD5 3dfcb5630cdda448a010401b348b5f74
SHA1 f4d96643f5321db70dac428121e5b76cb2694ed9
SHA512 6597398ff259a5bcf0ce7aa369a4d333f3a2b276befd25270b0f91c227b84226ea6cb6fc3d06e4caa20e5f6e0da8c7014aab1ad14dd912c21c0594055f51fb7a
TLSH
T16741B7D97F093075FF82CE825D79C73A2E38F1849844649A70FBC8E27895B983D1A45C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 ec3009898656307ff86e13639e0ddc0158b2cbb0b1b22dd185e0abace0c3f66e
MD5 9a0430f05aff8e1e79bbf03a6115e247
SHA1 c17d05b53460772705c13c88e553d9152911557d
SHA512 b168c3016c3dfcc372ccc3e9c4883165cec32298f2479d8eac999f4a37fa5c26d933daadc16e85c5f3c9a00712f1dd07700d1b2bb5b33a862796c80ad5910ea8
TLSH
T16D41FAE72B0538EC6F428F491AF9C47A0E3D82E4E1C01C82B8B7C8C214DE7E16916C4C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 5f6937376e0715427d3fd7030d975cea9cf7b2e798f0aeb3dd521211767adfa2
MD5 20fab2d4ec5df6a1a2be5ae74b67f9d3
SHA1 f0cd0fa62389e12856f60797abd3adacfbd26d0d
SHA512 67dda0ad3f3c1429223ca6add6f3147f7fca9d56b6a02942c8b65f7cd63d26fcb710ed4c20e2302ad40bedfbadcaafab279e324ef86b1f08fe5d119439965697
TLSH
T12EF068243DFF913BF5A6DB3803D4717199AAF25630011AB427F6134A2E14F617C5292D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 b50e3631eea50370e5a5d82ae97aead2e57bcf2c36b7520f8981c4a0889715c6
MD5 46265466535aeba99648d6c758378a84
SHA1 d1a7607e2247c6bf7253ac129c645af1161dcf4c
SHA512 e262a9c13fef33e282ec61dca6988ccbbc2d615f579004da332eca1557b87471fc8c07384a6602311605e155b0f14670c5700e2da1833abda08ec274a1a1ece8
TLSH
T14CF0A33835AF112DF172E9B902C021D6C423E1332005276C37B253491D65D817EA0E2D
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
Size 113KB
SHA256 f57582bee5a7622850fbb962dd34e80870f590b475cbbebc9d831d39d7103bb5
MD5 3baeef2949013f19b93465d34064be0a
SHA1 374d8c7ddf17f06aac458f431a486c05608fa07e
SHA512 a98be1ad9cfd7b93a700e6b250b86ce493b68ffce92e3c319f73598f21730d12632ec692c30fdd27983e470257a2eef6a1f4cbcaba9267e1b36c007b83a3fefc
SSDEEP 1536:r0kwU8LawT+nOFI2vbVq5khfpIdM30sgQCfZo+U4YTuG9VNRsd:7ozT+OF7vpLhfuWBrCBV8rVsd
TLSH
T1C2B33A27FA56107DE161C6BACED78D52EF317C8A07916BEF07804CE24E562C0AF39612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup.bat

Path C:\Users\Admin\AppData\Roaming\startup.bat
Size 84B
SHA256 4077612ca739881994a7302223c47787c4404e864c6d5b2838e97167b11b643a
MD5 0ab7bb817698b3de4cce043be6900615
SHA1 e38dda9b701c8df940b1e93f69c3006f8c5ceb80
SHA512 9a3b214fe4d611c63b38cfb1a98d932b84bd38e00b972cfbaaf58c9f4705f5ea031b1c452fcbcffc84db6cd76163e15b999c6a9ef1e8b3b85712bda39c933962
TLSH
T1EDA01206C1C4841B88241C4200D53F84B0360057A9406F01010048085D83889F0CB0C2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads