Overview

overview

7

Static

static

3

9e57c9d60b...e7.exe

windows10-2004-x64

7

9e57c9d60b...e7.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 07:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
  • Size 5.6MB
  • Sample260909-jbpwsstejf
  • SHA256 9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B60.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5672
      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4872
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EEA.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4748
          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2352
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8514.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5676
              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:692
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2376
                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:3040
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9159.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4608
                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5516
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2556
                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4624
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:6084
                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2560
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2304
                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1152
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:920
                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2900
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC896.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4544
                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3220
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE62.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4468
                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4740
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:6028
                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5708
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC4.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4352
                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:460
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE778.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2276
                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1492
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF534.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5352
                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5552
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF96A.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4392
                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5600
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD71.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:200
                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2396
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2892
                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5512
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38B.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2624
                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3000
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5160
                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3392
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a977.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1980
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2984
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC27.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2612
                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5112
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3576
                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4876
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5168
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2072
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA1.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:752
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4588
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10CA.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4848
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1572
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1203.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1656
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3252
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12ED.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4992
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4752
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13F7.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4628
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:120
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14F1.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1532
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:820
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15EB.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4184
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4648
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1713.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2704
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:5800
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17EE.bat
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4452
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3488
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18D9.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:2524
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4212
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19C3.bat
                                                                                                                                              70⤵
                                                                                                                                                PID:6088
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4368
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AFB.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1216
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5592
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BF5.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:2268
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2736
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CE0.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:2972
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4864
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DF9.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6052
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4700
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EF3.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                          PID:4132
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:3476
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FDD.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                                PID:5296
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:1436
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20D7.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:3112
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2748
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21B2.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                          PID:5852
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:3128
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22BC.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:5688
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2397.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:5172
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2481.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:5668
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a255C.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:5568
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2656.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2740.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:2140
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283A.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                          PID:792
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2953.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A3E.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:2084
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B47.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                            PID:556
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:6048
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C12.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CCE.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:1864
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DA9.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EB2.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:796
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FAC.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:3304
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3097.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                        PID:3004
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3181.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5412
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:5652
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a324C.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3317.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:2640
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33F2.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                            PID:3752
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34AE.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5344
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3598.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                      PID:1136
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                          PID:4104
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36B1.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                              PID:3732
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:996
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a378C.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                    PID:3824
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3867.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                          PID:2776
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:1240
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3951.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                    PID:5616
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A1C.bat
                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                        PID:5144
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                            PID:2660
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B16.bat
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:4496
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF1.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CCC.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1520
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5820
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D97.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2924
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EC0.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:3740
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FC9.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2168
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4094.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5176
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a417F.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1988
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a423A.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:712
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4315.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a446D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4528.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a478A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4874.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a496E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B62.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5054.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a513E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5219.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a539F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a544B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5536.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5797.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5853.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a598B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E7D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6071.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a617A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6245.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6311.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a641A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6979.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7020.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7188.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7243.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a730E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a758F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a764A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7706.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a789C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7967.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ADE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8166.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8231.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a830C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8473.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a852F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8619.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8781.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a883C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                    PID:4144
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:1696

                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                        $$a38B.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a38B.bat
                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                        • SHA256 1539cb9296352708f0055ecd93aa1ab61a7e586847a31a4af7c88c1c8ec173e1
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a679.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a679.bat
                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                        • SHA256 11825d9a4b3a766070aeccb8d1e69c859b78283f470130456abe280164dfa901
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a7B60.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7B60.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 5d74c80df2be6d935ac1ca0067d0f27ace58143c38deacc899e5b87857d5a29e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a7EEA.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7EEA.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 2438d23689163175cbea94fecb03a662a1c13246dbb15deb0eb33f03c148f70b
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a8514.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8514.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 c1aee479dd38ef4bd83f2776fec7cc42ac81082d559a41697d579a98306b0b6f
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a8B10.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 067f60685b5012d152ff29e83edb70b5cf45c7ab89c20bcb8d3915d6491cbb5e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a9159.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9159.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 daba0f37f1659966dbad0fc032d0dae1fc0aedef0612aff96cdc83b55cf3f354
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a977.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a977.bat
                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                        • SHA256 d6964e822c23562c8c9d6419d4380cc9d95255328cb98b481736a4b092899ad5
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a9B6B.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 58742fc25253e85dce9e419b4922ab1b8424820b825a7eef0cf20c9c588c64f7
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aA7CF.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 9512e50f3fe50e89d542080caa963cbd7476391d246c07fe9958f52c0559053b
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aAD.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aAD.bat
                                                                                                                                                                                                                                                        • Size 720B
                                                                                                                                                                                                                                                        • SHA256 25b39793fcc09c38577801777da777a5d049986b7dc0082615d713ca808ccd4a
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aAFED.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 7e9b1c728d84a8345050fc59a1ad629de5c875f4472c6ce537bf2f51dbb71190
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aB963.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 6dbff7a04dd932551ebc9f0846ea170e355e85441787b7fd15e6e6cdb41a54fe
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aC896.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aC896.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 68576666c704d34a5437f93a3216f799eb89a11407b9c7e283b736139f95f885
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aCE62.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aCE62.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 b3aa0adfefa3797fca70b682141b21f6d1407b1128fb07a477ab39618870c063
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aD6BF.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 3cccb7f5b9a92b2fffb314054d04b711849b4199a7386cfacd5b38741813f5c5
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aDDC4.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aDDC4.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 4d1febc99cc90f14bf7539231d0405634e5e08785824cbae7272b8729a6e09dc
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aE778.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE778.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 7c437ae9959c3482dfcdac77e7d50ca3b49abcf35be390f8af98da025a0ec325
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aF534.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF534.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 43d837e2e24301f2979e8c89b57df33670c2c5032fa8fce2514f1db906195105
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aF96A.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF96A.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 a8aa43be30fccdb8bbb90994f9c642d26944a81ff50f39cea2aaaf7adccea9eb
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aFD71.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aFD71.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 85812b2a90f60c8aa668fca609210e9aa0abc232c303c6faf4c24a6637a7db96
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                        • SHA256 a4ec31d8fb1e09a3f91c23f3afe21798b48fcb00e81f28889d74f2eccae3fa8e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                        • SHA256 a4bd4ac2ff878ed52fef06d08e8253eae893b3d11277ce5631858ad26710fe08
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                                                        • SHA256 3669a0195a208878c1c6aa71f860635f6535404d84057053f21385a015672bc0
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                                                        • SHA256 ad4ba786be5e5c557654421cd540748ef9403070746aea0781726a4f6510eefa
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                        • SHA256 ab57f1dab57e710691b68d6d1a204871aa3e1b49aa4cbcf7aefaf28709c1c42a
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                                                        • SHA256 7f3b86f9a534ecc43a231cc24430dda10b4f652669c2737f556f197f0803cd75
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                                                        • SHA256 cf58d96da12e3970f7acfbd21a62d92a88fb4d526eedc1223629d48e9111775f
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                                                        • SHA256 d9e24cd4ef4a05916750615514ff3509367628e6abc049e6caea514e2fe8c6b4
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                        • SHA256 f7bd05d94c15f8998525d3e191ee0b13665484fc125c175465dec9a8d7bef7d1
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                                                        • SHA256 40ddb0fe9c54989a859e138ac579b2310f3ff580dbc42976552f9075d1252fe2
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                        • SHA256 9a9523912365e90dec1d19f760119042bb93d70cca28e93b544ba7ca567f6d75
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                        • SHA256 936b978bee329fc9a49eadb14f7bcb853d3ec6650bc0bad277092b4c6e27a7d1
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                                                        • SHA256 01e14151f9cc0a18830cbd6aabb698a0197db69e0165fdce36f5ec23469ad4dc
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                                                        • SHA256 7eb8f56435925acee32c84173ea7ab77284f7c18054299e95986fbe3d323b0e5
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                                                        • SHA256 5f0b3127acd3f113649e0220ac97e3a438ef91259bc08000532654aee54d2da8
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                        • SHA256 92d0bdd24fbf760ccc82e2ac9318fca052c677947ff3d49c49810a3bae2a262e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                        • SHA256 41809198f8666fbdc461cbdeeb7a8d0573e2b1c60e970e8e4b093d2d9b4a9c2a
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                        • SHA256 2df043f20bf2b14701413fc275be7f123f9f007076eb3710c1b4ee627c920b6c
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                        • SHA256 9238c872ac385da31ec2c1ee08b85b4c74fd70705fa3e73fc38341d1d21a3833
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e57c9d60b1682e5482e249a43dbbf854710d5f1065b8bac052d7ab3f219aee7.exe.exe
                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                        • SHA256 8c188127797fb5f1e075d7638780f1f286501ba4ce0bca1ba4768ff91e805f5c
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-2246396966-3025826688-3847171515-1000\_desktop.ini
                                                                                                                                                                                                                                                        • Size 8B
                                                                                                                                                                                                                                                        • SHA256 63ac03b504f1e786eb463eec969f243dd00f1128284d4d8d1e0017f1beebfe81
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        memory/108-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/120-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/460-8043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/624-8669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/692-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/712-8416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/820-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/916-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/960-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/972-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/996-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1052-8747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1060-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1100-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1152-6013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1168-8464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1240-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1312-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1380-8428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1392-8735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1400-8440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1412-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1424-8723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1436-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1444-8855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1492-8052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1560-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1572-8131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1764-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1820-8452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1856-8458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1864-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1972-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2072-8121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2076-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2112-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2244-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2352-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2396-8076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2436-8705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2540-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2560-5220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2568-8675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2572-8693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2584-8711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2640-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2660-8361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2696-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2736-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2748-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2764-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2792-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2852-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2900-8008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2984-8106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3000-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3000-8092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3012-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3040-237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3048-8717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3104-8837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3128-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3172-8759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3184-8819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3192-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3220-8019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3252-8136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3304-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3320-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3324-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3344-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3368-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3384-8813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3392-8100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3476-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3488-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3504-8422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3564-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3564-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3580-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3668-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3724-8861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3780-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3800-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3928-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4100-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4104-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4144-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4144-8012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4144-2724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4144-1820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4212-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4216-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4252-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4260-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4368-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4372-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4492-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4504-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4512-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4516-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4548-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4560-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4584-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4588-8126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4592-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4624-3588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4648-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4700-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4740-8027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4752-8141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4764-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4784-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4800-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4804-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4840-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4844-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4864-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4872-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4876-8116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4888-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4916-8729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5016-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5036-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5040-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5076-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5100-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5112-8111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5164-8843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5172-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5236-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5376-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5400-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5404-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5408-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5468-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5512-8084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5516-1825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5524-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5540-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5552-8060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5584-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5592-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5600-8068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5616-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5652-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5708-8035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5744-8434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5788-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5800-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5820-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5884-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5896-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5904-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5940-8687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5960-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6004-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6048-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6124-8801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6140-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download