Overview

overview

7

Static

static

3

507271317a...00.exe

windows10-2004-x64

7

507271317a...00.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    79s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 09:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
  • Size 6.1MB
  • Sample260916-k7vmlahn5s
  • SHA256 507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4200
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A25.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5372
      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5764
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9205.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4276
              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5688
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9522.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5612
                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:1908
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a990A.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4868
                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3776
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C46.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1460
                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4148
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2376
                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2168
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9F2.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3540
                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4956
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2636
                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5208
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD3B.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5360
                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1456
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4184
                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:5140
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5968
                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4744
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6E0.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:424
                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2120
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9DE.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6100
                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2768
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE04.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1844
                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4668
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD17F.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1156
                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4260
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD45D.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4424
                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2784
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD74B.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5252
                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2888
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAC6.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1808
                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5456
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD37.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5888
                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:256
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3556
                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3216
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF0C.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3952
                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5848
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE006.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4316
                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5324
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2440
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3472
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3580
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2908
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE303.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5708
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5872
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3FD.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2612
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4428
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4D8.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4264
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1624
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4660
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5876
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6CC.bat
                                                                                                                          60⤵
                                                                                                                            PID:4696
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2396
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE797.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1552
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4920
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE872.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:2252
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:4512
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE97C.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:260
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4528
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAB4.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:5452
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3804
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB8F.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:5236
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2336
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC89.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:752
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5788
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED64.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:984
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5180
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE4E.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:5488
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1820
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF38.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:2452
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5916
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF032.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1636
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:1980
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF10D.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:832
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4464
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1D8.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:1904
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4372
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF340.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5040
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:3756
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF42A.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:5960
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF524.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF64D.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4588
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF776.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF850.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4708
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3420
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF96A.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2160
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA64.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB7D.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                  PID:4816
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC58.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:1408
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1164
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD81.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5464
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:3624
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE5B.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                    PID:2924
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:4256
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a169.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:1560
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a243.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                    PID:3588
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:5068
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31E.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:5020
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3248
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a428.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                              PID:3740
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a522.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61C.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:5840
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a725.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                PID:3304
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                    PID:4736
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a800.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                        PID:4272
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BC.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:2652
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:1296
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:240
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE.bat
                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9.bat
                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC84.bat
                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                          PID:1020
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                              PID:6056
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6F.bat
                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69.bat
                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF53.bat
                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1068
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a101E.bat
                                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2116
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:484
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1118.bat
                                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:3848
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:6080
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1222.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3228
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3152
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12DD.bat
                                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1228
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13D7.bat
                                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1788
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:3548
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a159C.bat
                                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1677.bat
                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1742.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a182D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a206A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a223F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2471.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a252D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2608.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a278E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2944.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3162.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a321D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a347F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3559.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3692.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a376D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3828.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4046.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4102.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4288.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4567.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a477A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4816.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a496E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C5C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DE3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5063.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5100.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5248.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a539F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a542C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5555.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a568D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5739.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a593D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:628
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                25⤵
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5264
                                                                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                    PID:432
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                      PID:5132
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 984
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:4192
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 984
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 432 -ip 432
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 432 -ip 432
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:3784
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 432 -ip 432
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5904

                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            $$a8A25.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8A25.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 95bb2c7c94004045884f4986d02145000a862673683ab98dd88aef83762e9442
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$a8D61.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 9f8951b78b3a85a85dbaf1ca43f3d9cf7b2e69778c86657e28c4dd1ef68901b6
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$a9205.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9205.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 0e007a829b2fa14daf1813659278d90b25e6552be3cedf8a8c97df403e9ec624
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$a9522.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9522.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 b51d8585a3c9ff5cb8b7b17b4dbb410ed2dc1a63e17afa0769b9ab3dc44626ec
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$a990A.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a990A.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 798c478e913ecc08a133cc808e10c3260a779c445c6ba826a4b59279218e7e16
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$a9C46.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9C46.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 4629f9245d83aa328b077f25f7321a53772647fdf6b3f90172fed806702a24bf
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aA07C.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 9a545c755d0b46441d0bb20425c58b8f66624c0201a02f90f30207372452e676
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aA9F2.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA9F2.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 afb236f063d4ffb0fedf9b1e01c7ec4ca6db87c61cae75ce41a48ce7c6598bb8
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aAE57.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 b8bfc673b254fdb5bfb833d155c60e4ac1f2dfa9f311f23f46d4dd11cbafda33
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aBD3B.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBD3B.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 b7d5797b9e8219ec6ee1a0ee2a48bc4789bc15f89977ef4015388b9ba8ea6c77
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aC078.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 53e2da83900a0575ead43c77d37c87e1390ff1796990f1945dbe5a4f68ed462f
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aC3C3.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 86444a78f4a301f7c0e6976b79ec8c5adb092fa1345da6dbead94d391ce6578d
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aC6E0.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC6E0.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 9e3fd6d586fdb90e196d0ef18e1e40edf97896c9df8abad6d8e86af4bb104414
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aC9DE.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC9DE.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 18b54be051a6bf027fb0f13876b3b823fc51156c6bda4095779427840cd5cdb1
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aCE04.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCE04.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 64e7d325c9a40a998d1b289aa9b01feb5534fac14b009a5353acde675637bd8b
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aD17F.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD17F.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 a7976ddef83a76d8f41e8dc30661e2aae7b195beb94e6de755b0077220c40282
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aD45D.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD45D.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 ded907b6faa5bc5502d35e313bebf935da7ce6ac14ac483e844baee716c10a20
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            $$aD74B.bat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD74B.bat
                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                            • SHA256 d54de5eb857fe33882ac63cebf75121bd49f3d2f0ca92e3ae33e829c4f23ce4c
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 6.0MB
                                                                                                                                                                                                                                                                                                            • SHA256 8bd8f1e07c852dcee1c617318ce381581df3aa58c73393f0d25631b4faee3bc3
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 6.0MB
                                                                                                                                                                                                                                                                                                            • SHA256 f9278ad439492bdd296f422920c41eb1a08730baf63e4d9eabfa0eef7b693ea2
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                            • SHA256 9ca5367ba1a152a4580a8f4477ce0a4b8a45da7008864419f81223e5b3d5d82c
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                                                                            • SHA256 217808f5369bb7a92015af00c8605ed655f6036661041ecb9001f6f6a67b4166
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 6.0MB
                                                                                                                                                                                                                                                                                                            • SHA256 051b0bf444b7926077cbf60a1e76236c9637e5187549be2af960332ab00a1d9b
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.8MB
                                                                                                                                                                                                                                                                                                            • SHA256 a1cce739b0b21e50237f2ea5e1b0b7b91ff85923b613a0249f9e880f914d2500
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                                                                            • SHA256 38cc3ddafcffa488bf242d86dd7a138c64610110db074ad9b95232fa9ae969f5
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                            • SHA256 c436cb27c5073fa168175eec04b6d47efd1b9f4a80c13c98f20beeb5900f57a3
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.8MB
                                                                                                                                                                                                                                                                                                            • SHA256 28f90c32f8d3e275f4157341674b04cec1a31b803b86dd9e5fafac023e509966
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.8MB
                                                                                                                                                                                                                                                                                                            • SHA256 26b249c4290d015fa31872b9152854cc39a8f9549a5aaa50d8c459d364a5f205
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                            • SHA256 770214f471121442344c935b8dd51403f797ef2582ca77285e1d2711ce6dc0e7
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                            • SHA256 fd037e34c3f00ea4bb9735ed63e48defb98f37610e4f6f1bdafd0ff4b3f77135
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.7MB
                                                                                                                                                                                                                                                                                                            • SHA256 f28b0e372f2f76f1f61f7dd6214448fc5e193b0cc7f5cd625e34eb0fb2b358b0
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.7MB
                                                                                                                                                                                                                                                                                                            • SHA256 f3d4a8dcee14039c3597a7981e8c2647c5cdf80740e6e7e5ccabfece9927c8a4
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.7MB
                                                                                                                                                                                                                                                                                                            • SHA256 e3217e9cfe7cbc089e8e148b007b57f114072275e5e089636f3f0eef016bdb0c
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                                                                            • SHA256 c231819e6ad7a89c4163b03a73dfa313f64c9165f1504a7624bce0f2431f3106
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                                                                            • SHA256 ad9da76c9500eb84904a67a361a4e27b85b43701f0a5c3b974eb010e95753465
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\507271317af2af6084db37a23862c91b79d013419114adc6321ece88cf4e9600.exe.exe
                                                                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                                                                            • SHA256 027a8fba4a984bb94252b75fb3270d3e41d0d683a86cba656234305d48c0c307
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            Dll.dll
                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                                            • Size 68KB
                                                                                                                                                                                                                                                                                                            • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                                                                                                                                            • SHA256 adce21c38863e3719070b76cc57d41c4a6461464168032427c8b59beb6ce354c
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            memory/256-4448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/428-5052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/432-1842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/432-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/432-4361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/432-2301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/484-4726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/692-5124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/804-4931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/944-5009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1000-4985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1068-4720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1164-4609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1180-5172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1188-4901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1228-4745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1240-5148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1296-4678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1328-5040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1368-4781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1436-5015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1448-4853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1456-4359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1464-5142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1504-4654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1532-5112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1560-4634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1624-4488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1660-4991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1724-4835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1728-4649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1820-4539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1860-4967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1880-5088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1908-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/1980-4549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2044-5058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2096-5064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2120-4395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2160-4594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2168-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2288-4811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2300-5021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2336-4524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2396-4498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2488-5160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2496-5154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2544-4907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2548-4793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2572-4619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2588-5027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2592-4775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2684-5076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2748-5118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2768-4405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2784-4429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2888-4437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2904-4871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2908-4473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/2988-4805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3096-4961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3108-4799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3152-4739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3172-5046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3216-4453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3248-4644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3268-4624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3300-4823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3420-4589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3472-4468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3504-4919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3544-4979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3548-4751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3624-4614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3724-4847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3744-4955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3756-4564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3776-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3804-4519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3808-4925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3872-5082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3888-4817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4044-4865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4048-4769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4064-4672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4104-4883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4148-128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4156-4949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4200-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4200-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4208-5100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4260-4421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4268-4690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4296-4696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4372-4559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4420-4714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4428-4483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4432-4973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4464-4554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4504-4763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4512-4508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4528-4513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4580-4599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4588-4579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4620-5184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4628-4895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4668-4413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4688-4889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4736-4666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4744-4385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4768-4604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4784-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4848-5130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4860-4757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4892-4829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4920-4503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4932-4937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4936-5070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4944-4684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4956-1959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4976-4584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4988-4708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5004-5166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5052-4787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5068-4639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5088-5196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5096-4913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5140-4374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5156-4841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5180-4534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5208-4351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5324-4463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5380-5106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5448-4859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5456-4442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5484-4514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5484-4443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5524-4997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5564-5178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5624-5003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5640-5094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5688-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5764-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5764-2798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5788-4529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5796-4877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5824-4574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5836-5190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5840-4660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5844-4943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5848-4458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5856-4629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5872-4478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5876-4493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5904-5034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5916-4544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/5960-4569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/6048-5136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/6056-4702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/6080-4733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download