Overview

overview

7

Static

static

3

ab16ddf16c...f8.exe

windows10-2004-x64

7

ab16ddf16c...f8.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 09:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
  • Size 5.8MB
  • Sample260916-k8antahn5x
  • SHA256 ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D93.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3872
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80BF.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3424
          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a840B.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3392
              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3936
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8795.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3588
                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:3856
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AF0.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:6032
                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:6092
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D90.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1832
                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5812
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90AD.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5412
                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:940
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9735.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5316
                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:3452
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F44.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3492
                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4144
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA270.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3508
                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1568
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6E2.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:1296
                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5488
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1372
                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1176
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE64.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5148
                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:248
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5344
                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3376
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC615.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1872
                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5104
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4380
                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1180
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC8D.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2916
                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4892
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFD9.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6024
                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3188
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD306.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3484
                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:6064
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD603.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1748
                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1000
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD70D.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2436
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1112
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7F7.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5936
                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2452
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD901.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4476
                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5792
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9DC.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1992
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4272
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3812
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2760
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBB0.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3084
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1132
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC9B.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5964
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2368
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDA4.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:764
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5824
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE9E.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4640
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4708
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF98.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:4788
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:2508
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE083.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3180
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4384
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE16D.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:1264
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:1160
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE238.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:2336
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2068
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE303.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:2588
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4668
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3DE.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:3364
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3964
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4A9.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3820
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:1380
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE594.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:1012
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:864
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE66E.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:4952
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:2696
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:2560
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4108
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE853.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:4292
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:3296
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE95C.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:4596
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:1972
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA37.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:832
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:1352
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB12.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:1776
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5968
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBFC.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:2816
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED06.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDC1.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:3496
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF77.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1648
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF090.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                          PID:2032
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:3456
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17A.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2972
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF330.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:5564
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3FB.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                PID:2456
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:1424
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4E5.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                      PID:3684
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:6004
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5DF.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                            PID:3192
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:4400
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6E9.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5436
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:4372
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7D3.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF89F.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:3164
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2512
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF96A.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:4440
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA25.bat
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1208
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4488
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAE1.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                      PID:5328
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB9C.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:3224
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC58.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:5072
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3468
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD13.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                    PID:2284
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDEE.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:1300
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEB9.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF75.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5480
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a214.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                      PID:5852
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                          PID:3268
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF.bat
                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6120
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3140
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a485.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a560.bat
                                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:1348
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61C.bat
                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1640
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5752
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D7.bat
                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:996
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6080
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A2.bat
                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:4368
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D.bat
                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:3788
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1472
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a948.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA04.bat
                                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF.bat
                                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:680
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a104D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a128F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a135A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1406.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a157D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1648.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1713.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a184C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1907.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2089.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2145.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a226E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2471.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a250E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2702.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a284A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2924.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3049.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a321D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3385.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3431.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3559.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a373E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3867.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3922.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4027.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4160.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4298.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4334.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a443E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1824
                                                                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                          29⤵
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:2416
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:3340
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 1044
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                          PID:1860
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 1004
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                          PID:5876
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3744 -ip 3744
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3744 -ip 3744
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:2868

                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              $$a7D93.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7D93.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 473b5241111152f5184a2b0a53a50ebcc1a4e03b46921a1e4f9e2f7f7607c237
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a80BF.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a80BF.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 fcdd915a18f0fe29e2cdad8d5c08fe150eaebcfcf2b2323e9e636b0a7f7a4244
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a840B.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a840B.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 969838e27bf039ba54a87031a759fb286a7685bcb145f27c51352b7eb87a7561
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a8795.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8795.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 d8de8750511898a95effc87f6cc6c63b6f46e0d265e4ad72081db944dee181df
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a8AF0.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8AF0.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 063b7ce0d458a1b56b20f4e2a692b565ab86dadb116d4b115b8ded4b015c62bc
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a8D90.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8D90.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 ff810fa757b9837e76feda50a159f2e343d4d7feb0a540398dc8999484c1d53f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a90AD.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a90AD.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 b3ac41c51dac3c0a13423bf867822692f8a84dc1d00fe5713c0ed051d94b60e7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a9735.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9735.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 d4c6ee84ab8ca3736d7e343d8d22f95d526ff05408493dbd68222b489c9a3a21
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a9F44.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9F44.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 9721f41721a667b69b00cfa4fb17dd034db1ae55e5fadb14ff585d640c44d4c1
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aA270.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA270.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 449f2a87cc501b1dcee45477e2f6c59a7b397c3684cf2e08672cd57cb22ec9f6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aB6E2.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB6E2.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 111e43af40fa6488fba1f9bea781aae4f48818b4fceb5e0e8f2d7deff5389782
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aBB47.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 347e34c85226c83e412bbe89f0ef15aa6465f2ec915bbfcdfa1d9db7930e2cf8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aBE64.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBE64.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 91cb201797045e2dbbd39027fe2f12251d412d93dbfd2101ac918719ab6e036c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aC375.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 cb7a5b42e0d4bc625f4d1e2f85c005613ad91aa3595c128c82ffa097300f72f0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aC615.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC615.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 8c5702eed1ebb9d74ffa72304f64581c6b473451233fd9c3607465e650319b15
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aC942.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 5095e082e0d82dd3d6f39a28673f27df83bf313ab9376582b22c53503b9c9efa
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aCC8D.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCC8D.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 b6e3de07ba11000599f021cf619339a97461414e7ba7b9c9f3ca04e03509caae
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aCFD9.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCFD9.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 72b5d65f73f3262fcbf6bb8ce2e0d8691981ffb7ff072103ed9530737c820370
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 1b39d99a2abee06f56d22a7ebe72586c16f47f2d5a702c9ede8968ea189fbd6c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                                              • SHA256 7fc70bfda241e1e2f5ffed39d52153aaa0fdeca5ce9c76de1200ed421932d35d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                                              • SHA256 6c622597093a66ab11b4e74f6e4cbd1ae11f6f8526d18aa17140cce3ed7566ba
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 81d594cda0f8d62c694cb210c60bbb58609da448a31deaf6ccac5c34cc8c734d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                                                              • SHA256 c6fb3376aeb745faa98a5d9efa5a9cafc76bcddc197869d6a6494224e503f446
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 6201327f2077ec2c62fb521441a15197b86b10d357ed8e19d6bd25514f15a307
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 b46a2c8a28c827668593a7862baf142713546b0edfdacae4764e0ba9151ff7ea
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 fe3b9cc327a011f3bb09f919f1d3f21f828f75055fbc6ba037375a070b8f227e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 21dbc6f123c1a0bf777f344882a667debfdd1cb31fb16f2a32cfd1c1c8370c96
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                                              • SHA256 74bdf264db3712423647defed532bd4af4106134e53516533c91beccb7767932
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 5e1d1c27dcf9d564147f9daf4762c53186314a11bdcbf26fd29ba799673c4264
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 fb5df21f6c21d24b4ba538048062e47995a55011eb8bff78dd856ddd0d864d92
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 d80316c48f586bba7cdbd2bd1c3c9a66aedb2fa17084426546042e684b287b5b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 4ff637743f315f2247cfcc7945678dc22a311d431050e4063550b9b1acf8a644
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                                                              • SHA256 d15e3b609635cab4398eda7df1f0bce7174b2e2f25e3b20bed3d9d28ffbce247
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 06768fbcb939818de384288e4d33919118f39a7ebb3bc93bce7e78576e448bb5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                                                              • SHA256 73dd0ea741ee3cd6752f6fec5285726f6efbb9044e3178df27c2e74032d94b35
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ab16ddf16c13b9aa4355f84f8f7a5112dfe1ce1a72218d6a754e23198699cff8.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                                                              • SHA256 51ec75ee7edf4cfc0101444dfb4110bfcc9ab58e4cb8cce68f3ee7bc4fcd4839
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Dll.dll
                                                                                                                                                                                                                                                                              • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                              • Size 68KB
                                                                                                                                                                                                                                                                              • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Logo1_.exe
                                                                                                                                                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              _desktop.ini
                                                                                                                                                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-53044966-3830981193-2402648431-1000\_desktop.ini
                                                                                                                                                                                                                                                                              • Size 9B
                                                                                                                                                                                                                                                                              • SHA256 adce21c38863e3719070b76cc57d41c4a6461464168032427c8b59beb6ce354c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              memory/204-5494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/248-4773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/620-5216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/864-4915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/928-5470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/940-598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/988-5398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1000-4829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1112-4834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1132-4860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1160-4890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1176-4757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1180-4803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1184-5290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1220-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1220-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1256-5077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1268-5083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1292-5488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1336-5143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1352-4941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1380-4910-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1424-4996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1472-5137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1568-4741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1580-5260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1632-5476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1648-4971-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1772-5320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1920-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1968-5440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1972-4935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2008-5308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2064-5386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2068-4895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2176-5422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2192-5155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2260-5404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2300-5222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2368-4865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2376-5266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2452-4839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2508-4880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2512-5021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2520-5161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2528-5350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2696-4920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2700-5191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2756-5149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2760-4855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2764-5374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2784-5464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2816-4951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2888-5434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2896-5338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2972-4981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2976-5240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2992-4956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3108-5228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3124-5016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3140-5101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3148-5278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3188-4819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3204-5416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3232-5368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3268-5089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3296-4930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3344-5296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3376-4783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3416-5332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3452-1829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3456-4976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3468-5047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3496-4961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3540-5344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3612-5326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3668-5410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3712-5392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3736-5197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3744-4761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3744-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3744-2177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3744-1823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3856-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3872-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3916-5446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3936-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3940-5536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3952-5500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3964-4905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4108-4925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4144-1859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4156-5041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4180-5561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4192-5524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4236-5065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4272-4850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4276-5210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4336-5458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4348-4966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4368-5131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4372-5011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4384-4885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4388-5530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4400-5006-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4404-5167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4408-4936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4408-4840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4488-5031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4516-5482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4532-5518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4608-5428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4668-4900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4672-5203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4700-5173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4708-4875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4736-5185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4776-5246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4844-4986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4876-5567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4892-4811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4968-5053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5104-4793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5116-5107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5136-5380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5340-5506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5348-5026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5352-5452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5360-5512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5420-5542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5480-5071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5488-4749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5492-5179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5564-4991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5636-5362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5736-5284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5744-5113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5752-5119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5772-5302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5792-4845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5812-79-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5812-81-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5812-3767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5824-4870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5840-5036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5844-5272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5848-5314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5888-5254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5968-4946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5996-5356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6000-5548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6004-5001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6040-5234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6044-5248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6052-5555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6064-4824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6080-5125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6092-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6120-5095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6140-5059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download