Overview

overview

7

Static

static

3

3bc7ff394e...08.exe

windows10-2004-x64

7

3bc7ff394e...08.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 03:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
  • Size 6.3MB
  • Sample260824-dmb67asdrc
  • SHA256 3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FBE.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3088
      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3316
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a429D.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3864
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45AA.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2564
              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4508
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ADA.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5348
                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5820
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DE7.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3936
                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4536
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50A7.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4068
                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1184
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5395.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4780
                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:6028
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D1A.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1780
                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5000
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60F2.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4428
                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4332
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2076
                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4456
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7100.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4720
                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:4176
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4796
                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4764
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76AD.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:716
                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1288
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a791E.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3032
                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2560
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C79.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2500
                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4820
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F48.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3836
                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5864
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1544
                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4696
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8459.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3824
                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5840
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3268
                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2832
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8999.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4856
                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3476
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A93.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5220
                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4320
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B5E.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4272
                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2772
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C48.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4228
                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4064
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1612
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:460
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:256
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2000
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EC9.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4192
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4588
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F84.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2028
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4252
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a906F.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5504
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1352
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3044
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:1724
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91E6.bat
                                                                                                                          60⤵
                                                                                                                            PID:2168
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5712
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D0.bat
                                                                                                                                62⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3496
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2392
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:5856
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2824
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94A5.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:5336
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:3512
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1028
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5988
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:3624
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:6104
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96E7.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2016
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2696
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D1.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1576
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5520
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a988D.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:3932
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5464
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9948.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2924
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:4444
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:3500
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:5724
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AFE.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:3020
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:3504
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BC9.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5272
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3332
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C75.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:1076
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:5372
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D40.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4816
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:3340
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3028
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ED6.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4072
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F82.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2464
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5256
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA02E.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4400
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:1328
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0F9.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:3480
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4188
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1D4.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:1412
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA28F.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA34B.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3E7.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                            PID:5780
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:2920
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C2.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:792
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA57D.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                      PID:3100
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA648.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:5596
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6F4.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:200
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:1008
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA791.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:3768
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA927.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9D3.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:5732
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAAD.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:6084
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:3324
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                            PID:5924
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:5456
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC05.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:3076
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACB1.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                      PID:4244
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD8C.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                              PID:1160
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                  PID:4972
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:5492
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:1460
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF22.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:6008
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFDE.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:5200
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                            PID:5624
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB193.bat
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:1228
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB24F.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB358.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB433.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:264
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4DF.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5356
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:860
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BA.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:4100
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB685.bat
                                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4156
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:3360
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7FC.bat
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBACA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC172.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC421.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC654.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC857.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD075.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD19E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD22B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD47D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD509.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD632.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD76B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD816.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD94F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE006.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE13E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE248.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE565.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE68E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE71A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE94D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF080.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF11D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF19A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF459.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  358⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      359⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF572.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          360⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              361⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  362⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      363⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          364⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              365⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  366⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      367⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:796
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                PID:1224
                                                                                                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                PID:5176
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:1420
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 1036
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                  PID:2168
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5176 -ip 5176
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:2772

                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                    $$a3FBE.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3FBE.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 3cd460a2b616c0dd18d9aa2f72a025cc98f89c561343b842ca4ca10d51157918
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a429D.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a429D.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 e8032e60e5c31fc66d903d9e76d2f8a4b88e80a443899806d31a38e00f1ac0da
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a45AA.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a45AA.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 bd3573ee0cffec47b35037be0a204bd085c901632fd18b97fdfb0e8a758d3972
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a4ADA.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4ADA.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 38bee3bcf5860dd3cd21cbca6ac6c1ddbecaf2bdf6d7663d3878fce6d3fc2cf2
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a4DE7.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4DE7.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 32507d5402a613f327802ad514bc1d35273322c8ed110fa73450fed3fda6360b
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a50A7.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a50A7.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 e605d7214d3d079e908eb61dfde6d797765d65ca89a614359ff879414de08497
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a5395.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5395.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 cf5b60651fce4546681b77bf1727c5502a73c08bf3da5e74c7091e7db27f7568
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a5D1A.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5D1A.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 eef9b489dfbc52befa7771c1794594f0c23b20a50f330098f01f858b362c7a36
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a60F2.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a60F2.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 6b64ed500eab59d20cf9a38416fcbee1fcb8f4c941096e31dea313206e624bae
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a66AF.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 cf2833b020997ecfbc34122e49107576d2bb312be7406a1a496b1195805cef12
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a7100.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7100.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 b95c255b0f0860053a65b3610949337afc2076748cacbcb20cf33895c951e0fb
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a7371.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 fed63b87386a3b7035763a929db7a35f6d1192878140c5ef488c68dfa10b6117
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a76AD.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a76AD.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 3382857a7345d3987b4f83943af04798980b61ff3d53829a182bc1dffa914fdb
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a791E.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a791E.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 96699a96d1de651ab4dd51b91ac14ff781617078ae87e8da399c0a560c043971
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a7C79.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7C79.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 3e1c69213ce85215eb0eda65db43325cc9d15a322fa4de1cc7b9902a3decd3b0
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a7F48.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7F48.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 da149fba9dd31ce71f9e0b8077c6aba8526b7cb3d1d024fb2f48cb54a65491c1
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a81D8.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 1253f209967ef3ebf1d7de81e9e38b49df85b32ffc13fb1fa4a424d7dd999798
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    $$a8459.bat
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8459.bat
                                                                                                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                                                                                                    • SHA256 812be694c6ad00bbad74206b4dceb00cb7e1bc242c795cc7ff875e21b51e2d4d
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.0MB
                                                                                                                                                                                                                                                                                                    • SHA256 9e55a894703ae53d2e7602b29fd903ff5c4ff639abfb93f4470918ade6a25002
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.9MB
                                                                                                                                                                                                                                                                                                    • SHA256 deed65f8a562ba99f92fa86d8fed9f80007c16f72866d7d148c05a5ce0850354
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.9MB
                                                                                                                                                                                                                                                                                                    • SHA256 1c38ee5bddb0cadd6726afede31b6dc8f1e4e6eadf72c9cf98a5b8e3244a5cbe
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.9MB
                                                                                                                                                                                                                                                                                                    • SHA256 93e467d02bf3d3e647c5c55df7ad8df15495885bab88990b1ffab4e69ce8b1f4
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.8MB
                                                                                                                                                                                                                                                                                                    • SHA256 86fde8df410750aa526b18c98519d892c5784e5dbf579c6c4be1e99c1bfb8d0d
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.8MB
                                                                                                                                                                                                                                                                                                    • SHA256 666af296bbc462e30d94c1178474948dcddf1ca9e7f5bccaa2130fcc46143612
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.2MB
                                                                                                                                                                                                                                                                                                    • SHA256 7ebc3f1c93f29b721569d9b0f3bcf002135ec205b4769be61e68858d3ded5cf3
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.0MB
                                                                                                                                                                                                                                                                                                    • SHA256 02112603d803da30bc466e7ae5ef7f577872a6fbed76322344115314cc14aecb
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.0MB
                                                                                                                                                                                                                                                                                                    • SHA256 153b82e5bd568467edc0a5b4e5a9814bf68b0e07bf65413f7c6128a41f6b50c7
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.8MB
                                                                                                                                                                                                                                                                                                    • SHA256 a221f4721e368bb458535378acb12a6017f98b671287bebf1ee1617cdeaeb14b
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.2MB
                                                                                                                                                                                                                                                                                                    • SHA256 f1ed4a7148b849e5edbda895cdc147a03fbb40f4535d440a0ba55f2061f28a9f
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.7MB
                                                                                                                                                                                                                                                                                                    • SHA256 87e4b6dde88f3ed99dc350e7771be940dcbc4168e3e82193215b3fb1a0d77e6e
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.1MB
                                                                                                                                                                                                                                                                                                    • SHA256 73950e05849c25c20f70299bb74ce09f936a305ccf66d2e7b29250a3b57435eb
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.2MB
                                                                                                                                                                                                                                                                                                    • SHA256 0385716d6448ce45bcc08b9a8775faf931bf05db042838449f2671f3b5b39e3a
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.1MB
                                                                                                                                                                                                                                                                                                    • SHA256 47f357e297046e2802263495edbc0372344be4415e0d4bbf5b76bfd7aff067cd
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 6.1MB
                                                                                                                                                                                                                                                                                                    • SHA256 79108e02c1a7530fb4c250d3245038247d2a6882de987e6ee60102f6015c76f8
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.8MB
                                                                                                                                                                                                                                                                                                    • SHA256 2c3586f287b0648654e9dab23e4348c267eb8d233c1f816d576381b9f4f79e85
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3bc7ff394e14c7c87dd6c315228ae6b3282a166bc795443630ee7e7bddb93808.exe.exe
                                                                                                                                                                                                                                                                                                    • Size 5.7MB
                                                                                                                                                                                                                                                                                                    • SHA256 38fd81434c9b2d6dba1793aa56cc81a9c3dafdc927d763c3650eb530edfb0231
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    Dll.dll
                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                                    • Size 68KB
                                                                                                                                                                                                                                                                                                    • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    _desktop.ini
                                                                                                                                                                                                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-3989226554-2204910950-1522900112-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                                                                                                    • SHA256 e7a73e3169f6957e81cc3715978360652a0c0c7f11314e8d737cf084f4bd5e71
                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                    memory/264-5318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/460-5054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/580-5511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/860-5324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/932-5439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/996-5433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1008-5220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1032-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1032-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1044-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1056-5745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1072-5445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1092-5643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1096-5034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1096-5130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1184-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1244-5372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1276-5205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1288-4979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1328-5175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1340-5607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1352-5074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1396-5661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1408-5414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1444-5210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1460-5276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1556-5264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1708-5523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1724-5079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1904-5589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1956-5426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/1988-5763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2000-5059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2008-5709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2012-5739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2064-5505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2324-5235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2328-5667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2352-5691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2356-5529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2364-5384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2392-5089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2424-5354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2512-5631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2516-5535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2560-4989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2604-5553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2680-5697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2692-5595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2696-5114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2700-5288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2712-5619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2772-5044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2796-5402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2824-5094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2832-5028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2904-5258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/2920-5200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3004-5655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3028-5160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3036-5733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3052-5360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3124-5390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3196-5378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3316-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3324-5246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3332-5145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3360-5336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3368-5685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3432-5601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3452-5366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3472-5637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3476-5033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3504-5140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3512-5099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3520-5420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3580-5769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3584-5787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3700-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3768-5230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/3864-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4064-5049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4100-5330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4176-4960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4188-5180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4252-5069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4268-5408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4296-5781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4320-5039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4332-2927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4336-5547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4432-5775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4444-5129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4456-4900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4460-5679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4504-5348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4508-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4532-5185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4536-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4544-5649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4560-5155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4588-5064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4592-5165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4612-5195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4624-5751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4644-5463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4660-5190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4696-5015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4736-5727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4764-4971-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4772-5517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4820-4999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4876-5475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4908-5703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4972-5270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/4988-5396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5000-1878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5012-5300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5036-5721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5040-5499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5056-5571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5084-5225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5088-5673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5104-5487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5108-5565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5176-4948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5176-3753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5176-1842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5176-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5252-5451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5256-5170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5276-5625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5280-5481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5284-5613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5332-5541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5372-5150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5376-5306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5456-5252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5464-5124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5508-5469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5520-5119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5528-5577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5540-5457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5596-5215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5600-5493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5624-5294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5712-5084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5724-5135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5732-5240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5796-5757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5820-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5840-5023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5864-5007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5932-5342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5972-5312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/5988-5104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/6008-5282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/6020-5715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/6028-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                    memory/6104-5109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                    Download