Overview

overview

7

Static

static

3

d42a6fd1e5...25.exe

windows10-2004-x64

7

d42a6fd1e5...25.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/04/2026, 10:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
  • Size 4.1MB
  • Sample260427-mheaeshs8v
  • SHA256 d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1279.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13C2.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4440
          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:412
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a173C.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3172
              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1300
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AD6.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1004
                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3360
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E51.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3588
                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4980
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a215E.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4232
                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3152
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a248A.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2340
                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2324
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a269E.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3084
                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2564
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2892.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2172
                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4024
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B8F.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2044
                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:4996
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E4E.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:392
                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2964
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a310E.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5080
                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5104
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a336F.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2188
                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2348
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3592.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4504
                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1616
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3832.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4944
                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4984
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AA3.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3468
                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4848
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C68.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3736
                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4300
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E7B.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:820
                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4296
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40BD.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4596
                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5068
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a433E.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4380
                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:756
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a439C.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2384
                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1448
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4428.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4116
                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2752
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4513.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2516
                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4832
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45DE.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4816
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:656
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a467A.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:236
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2608
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4726.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1028
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3584
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47D2.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1304
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:444
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a482F.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:72
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1188
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48BC.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2304
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3860
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a491A.bat
                                                                                                                          60⤵
                                                                                                                            PID:1184
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:3140
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49B6.bat
                                                                                                                                62⤵
                                                                                                                                  PID:3912
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3796
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A14.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:2268
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4104
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A72.bat
                                                                                                                                            66⤵
                                                                                                                                              PID:4712
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                67⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:1588
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ACF.bat
                                                                                                                                                  68⤵
                                                                                                                                                    PID:1488
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                      69⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4500
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B4C.bat
                                                                                                                                                        70⤵
                                                                                                                                                          PID:4496
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                            71⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2224
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BC9.bat
                                                                                                                                                              72⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2220
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                73⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:1908
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C56.bat
                                                                                                                                                                  74⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4288
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                    75⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2396
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CD3.bat
                                                                                                                                                                      76⤵
                                                                                                                                                                        PID:1528
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                          77⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1380
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D6F.bat
                                                                                                                                                                            78⤵
                                                                                                                                                                              PID:4580
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                79⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:3424
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E0B.bat
                                                                                                                                                                                  80⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3884
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:3840
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EB7.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                        PID:3384
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:3748
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F54.bat
                                                                                                                                                                                            84⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4324
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:4972
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FFF.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3896
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50AB.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:728
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2700
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5138.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1264
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:1036
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51C5.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:3716
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5242.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3932
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:4840
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a529F.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1996
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:1780
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a532C.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2620
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53A9.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5407.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5484.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5501.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4036
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:904
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a557E.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:3052
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55FB.bat
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                          PID:5040
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5687.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5714.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57C0.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:1160
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a583D.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                PID:3388
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58BA.bat
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                      PID:4976
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5985.bat
                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:724
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:3956
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A12.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:1172
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:3292
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A8F.bat
                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:1336
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AFC.bat
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:732
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:1196
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B98.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:3688
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C34.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                        PID:3560
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CB1.bat
                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                            PID:1644
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:2328
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D6D.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:3756
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DDA.bat
                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                        PID:1096
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2468
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E48.bat
                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:4512
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EF4.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4552
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                      PID:588
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F71.bat
                                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1860
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:3876
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FEE.bat
                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3324
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a608A.bat
                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:1892
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6116.bat
                                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2580
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:1060
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61A3.bat
                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6201.bat
                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a627E.bat
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2112
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:1232
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6378.bat
                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6414.bat
                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6491.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a652D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6637.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a676F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6889.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:232
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6935.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a701A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7143.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a728B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7327.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7395.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7421.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a755A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7644.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7700.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1852
                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:1612
                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                        23⤵
                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                        PID:3460
                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                            PID:2040
                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:2772
                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:2996
                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:2732
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 992
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Program crash
                                                                                                                                                                    PID:4732
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2772 -ip 2772
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1028

                                                                                                                                                                Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      $$a1279.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1279.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 dbfb01e35fbf3f5dab7252160813b47a3585ac69f9ee0b6f739d6d3296cee760
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a13C2.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a13C2.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 add670357b1b1a9422c11c1c7cf0268b97606780c2aca824697a643c6394b315
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a173C.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a173C.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 d4733f45632fe8dd779a112749676501aab676f3dde848853d551ff3dc01ef90
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a1AD6.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1AD6.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 1139533635e3e2df4abcb948a15e5cb4e0b9a1cfcca5efe3145c8cac4cabffc0
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a1E51.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1E51.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 0edf552ce34187cc5132527630ac08ef57bac642cc540c0a68440832fc92dbab
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a215E.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a215E.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 eb6df6d74d27f665204a397a91d93232df7f2fd4d1e9f28a486e485f785ef659
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a248A.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a248A.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 b430dc4a4f8d67a03163e2e7899a3b542e2319e319a3f74840df99640df145d8
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a269E.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a269E.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 3d19a2044219992fa5be1dac23a304faaca01aec1c8825e4d19e57846e8cb477
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a2892.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2892.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 d0324b1e539547b4a05797e9e33032b3c5091923164df240b8b6386783dfacd6
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a2B8F.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2B8F.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 abd154dbd5cf00480ca81b1df501171fb7e8442e1ce913dbc577ccf1feb8f7e5
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a2E4E.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2E4E.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 7805f9c6be8f2c1b2439ae19aca50ac706812c5b405350d4b01ad942a86d21fa
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a310E.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a310E.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 15f6705effeaddd98dc5cfb9f561e63fb7abd82e055fd15cbe46ca73ffe7aa4d
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a336F.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a336F.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 ce07477ef568e29f7a547e1a86d5835fbf030269ba23b1ad48e2da5df71bc2b1
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a3592.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3592.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 7eb5a787cb655950c2ec3997705ca08b65712387772c23ccfc84f1297b35c5f5
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a3832.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3832.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 a2d1aa5b24dd8f23a1fe794b88c48c31d7e5fd6a770f57a9ad9ad12c243b739d
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a3AA3.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3AA3.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 84a33c38635aea4715fad40c3b8f6f2367f25a024e0c06786e221549ec77ae85
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a3C68.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3C68.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 d695063297624f846969d382b5933d1f55800328215a9ad3e4bc8456265d8a0b
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      $$a3E7B.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3E7B.bat
                                                                                                                                                                      • Size 722B
                                                                                                                                                                      • SHA256 0762410614b48fbd461b0cfec015cc159160270da4fcc1b1a66d5e55b19a3c59
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.8MB
                                                                                                                                                                      • SHA256 b065634317a1c26c46b1f0da775f9531f20cbce3258a1f1367675cc5e9b12761
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 4.1MB
                                                                                                                                                                      • SHA256 7b9508444486788af126947016e3e53c5634d81be063fa48c2d7bf83b598c77e
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.8MB
                                                                                                                                                                      • SHA256 2aa216efbc62f387b2cbb7963ee0f9dd86116f1d4a7550a003293c7cc1eaec98
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 4.0MB
                                                                                                                                                                      • SHA256 2c490de7cce50a499d5aea33658d3d41e5a6d3f49b75b7bc71aa7d64b722664c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.7MB
                                                                                                                                                                      • SHA256 755ee46940e6eee30b49b9877e79611a19eea5515f6cc07b0e23df2995a11a92
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.9MB
                                                                                                                                                                      • SHA256 4ce7218fb5438de4866417d8dfdc6bccaf66e9d70c3196f7b8eb6679e692fd3d
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.6MB
                                                                                                                                                                      • SHA256 55562b732621b7c40776bf4fe14b83574b81e72e8ed0559baf994fd99a732f99
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.9MB
                                                                                                                                                                      • SHA256 8a9a296b482a7826d3ab0a3f99dba7102766ba0f312159a8d6973a6a9474c1b4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.6MB
                                                                                                                                                                      • SHA256 67a79a0a8964667586d6c410de886fb5186f16a1e173877ed58e906cc14ea8ed
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 4.1MB
                                                                                                                                                                      • SHA256 95767b635c667c1b17f3d13b7fee3223cb697e7cb47289508705a4de8562886c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.8MB
                                                                                                                                                                      • SHA256 224079139200e6fb886777710548fa5ffd113b4785e43c23ef2cd70a2589948a
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 4.0MB
                                                                                                                                                                      • SHA256 10da54c39ce57ef8dc2b56552208e2aa74f3e068e915c79cf221497050bbf56c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.7MB
                                                                                                                                                                      • SHA256 5199e96c05b9ed7f7596c94e73459c39a762e5bbe4183d5d85fafe2e5ea43c7e
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 4.0MB
                                                                                                                                                                      • SHA256 f9baea36edfb159345a176dcc6fe3b64a297846c520533c299687b14fe2e7858
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.7MB
                                                                                                                                                                      • SHA256 488420a1192560b6a2ca06265200c42594af1180f3aa29e4138306e7589192cd
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.9MB
                                                                                                                                                                      • SHA256 cad18153c636499315834715e67ba16e2a2070170d7e39e4790287ad13940df4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.6MB
                                                                                                                                                                      • SHA256 922d15c4cc4a3ad618324ed296f3f06a3c52f31bd8f70b62616ac3a07362b456
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d42a6fd1e5f009a667de7a2cd91d21871d9374fbf0169a631572b7eb12c5b525.exe.exe
                                                                                                                                                                      • Size 3.5MB
                                                                                                                                                                      • SHA256 08b76fd10ae474b0b81b43b24d2fe41731dd24e81960722870285d4e282ecafa
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Dll.dll
                                                                                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                                                                                      • Size 68KB
                                                                                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                      • Size 32KB
                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      _desktop.ini
                                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-1383858298-2057492509-1726743289-1000\_desktop.ini
                                                                                                                                                                      • Size 9B
                                                                                                                                                                      • SHA256 269dc3d27cf579ffd3ce12dd38c7363df12c3132e3e789b6c9243f7a3d535e49
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      memory/412-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/412-31-0x0000000002070000-0x000000000212B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/444-1087-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/444-1086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/588-1350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/656-1072-0x0000000002050000-0x000000000210B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/656-1071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/712-1530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/756-1051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/756-1052-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/904-1240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1008-1398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1036-1192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1060-1374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1092-1518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1188-1092-0x0000000002170000-0x000000000222B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1188-1091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1196-1308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1232-1392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1300-39-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1300-46-0x0000000002160000-0x000000000221B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1336-1302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1380-1150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1448-1057-0x0000000002170000-0x000000000222B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1448-1056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1512-1272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1584-1452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1588-1120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1596-1512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1612-1047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1616-1008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1616-1009-0x0000000002180000-0x000000000223B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1764-1476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1780-1210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1892-1368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1908-1138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1920-1482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2004-1278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2068-1410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2088-1422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2184-1524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2192-1314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2224-1132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2272-1386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2324-84-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2324-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2328-1326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2348-1000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2348-1001-0x00000000020E0000-0x000000000219B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2392-1228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2396-1144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2468-1338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2508-1464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2536-1222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2560-21-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2560-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2564-276-0x0000000002050000-0x000000000210B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2564-275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2568-1470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2608-1076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2608-1077-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2612-1615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2612-1609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2620-1216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2652-1416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2680-1488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2700-1186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2752-1061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2752-1062-0x00000000021B0000-0x000000000226B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2768-1506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2772-957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2772-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2772-958-0x0000000002020000-0x00000000020DB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2892-1542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2964-980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2964-981-0x00000000021C0000-0x000000000227B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2972-1608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3052-1248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3064-1536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3124-1596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3140-1101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3140-1102-0x0000000002060000-0x000000000211B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3148-1434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3152-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3152-76-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3280-1500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3292-1296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3332-1572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3360-54-0x00000000021F0000-0x00000000022AB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3360-53-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3424-1156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3560-1320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3584-1081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3584-1082-0x00000000020B0000-0x000000000216B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3652-1584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3748-1168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3756-1332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-1458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3796-1108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3840-1162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3860-1096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3860-1097-0x0000000002050000-0x000000000210B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3876-1356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3880-1578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3956-1290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3984-1590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4024-955-0x0000000002170000-0x000000000222B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4024-954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4104-1114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4120-1494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4168-1446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4192-1198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4228-1566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4296-1040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4296-1041-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4300-1033-0x00000000020A0000-0x000000000215B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4300-1032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4328-1428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4352-1602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4428-1362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4456-1440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4500-1126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4512-1344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4640-1554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4792-1380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4828-1260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4832-1067-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4832-1066-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4840-1204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4848-1025-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4848-1024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4856-1404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4864-1548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4900-1254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4924-1180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4964-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4964-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4964-9-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4972-1174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4980-66-0x0000000002020000-0x00000000020DB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4980-65-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4984-1017-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4984-1016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4996-972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4996-973-0x0000000002040000-0x00000000020FB000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5020-1560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5024-1234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5028-1284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5068-1046-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5068-1045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5076-1266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5104-991-0x0000000002170000-0x000000000222B000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5104-990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                      Download